Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

CVE-2023-4521

Summary

The Import XML and RSS Feeds WordPress plugin prior to version 2.1.5 is susceptible to a flaw that enables unauthenticated attackers to execute remote code on the affected site. This vulnerability arises from an oversight related to the handling of files generated by a proof-of-concept for an earlier reported issue. Specifically, the failure to delete the generated web shell files during the release of a new version poses a significant security risk. Site administrators using this plugin should apply necessary updates to mitigate potential exploitation.

References