The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027/ | Exploit Third Party Advisory |
Configurations
History
12 Jun 2025, 16:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:aleapp:csv_mass_importer:*:*:*:*:*:wordpress:*:* | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Aleapp csv Mass Importer
Aleapp |
17 May 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-17 06:15
Updated : 2025-06-12 16:29
NVD link : CVE-2025-4190
Mitre link : CVE-2025-4190
JSON object : View
Products Affected
aleapp
- csv_mass_importer
CWE