Threats tagged 'ghsa-rqj4-c9gx-xx38'

The Import WP plugin for WordPress, used for exporting and importing CSV and XML files, contains an arbitrary file read vulnerability in all versions up to and including 2.14.16. This flaw arises from insufficient validation of file paths in the plugin's REST API endpoint, specifically in the 'attach_file()' function handling 'file_local' actions. Authenticated users with administrator-level privileges or higher can exploit this to read arbitrary files on the server, including sensitive configuration and system files.