CVE-2022-36386

moderate-risk
Published 2022-09-21

Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.

Do I need to act?

~
5.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Wp All Import

Affected Vendors

Soflyy

References (4)

Third Party Advisory https://patchstack.com/database/vulnerability/wp-all-import/wordpress-import-any...
Product https://wordpress.org/plugins/wp-all-import/#developers
Third Party Advisory https://patchstack.com/database/vulnerability/wp-all-import/wordpress-import-any...
Product https://wordpress.org/plugins/wp-all-import/#developers
44
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 8/34 · Low
Exposure 5/34 · Minimal