Threats tagged 'ghsa-fpcx-rqjq-9vj8'

The WP Import – Ultimate CSV XML Importer for WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted CSV file data in the import_single_post_as_csv function. This affects all versions up to and including 7.33.1. Exploitation requires authenticated administrator-level access. If a suitable POP chain exists through other installed plugins or themes, attackers could delete files, access sensitive data, or execute arbitrary code.