Dieu Link

**Name of the Vulnerable Software and Affected Versions** WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.38 **Description** The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to SQL Injection. This is caused by inadequate escaping of the `file name` parameter during file upload, which is then stored in the database and used in raw SQL queries without proper sanitization. An authenticated attacker with Subscriber-level access or higher can append SQL queries through a malicious filename. This can lead to the extraction of sensitive information from the database. The vulnerability is exploitable when the 'Single Import/Export' option is enabled and the server is running a PHP version less than 8.0. **Recommendations** Update the WP Import – Ultimate CSV XML Importer for WordPress plugin to version 7.38 or later. Disable the 'Single Import/Export' option. Ensure the server is running PHP version 8.0 or higher.

**Name of the Vulnerable Software and Affected Versions** WP Import – Ultimate CSV XML Importer for WordPress versions prior to 7.36 **Description** The plugin is susceptible to Server-Side Request Forgery (SSRF). This occurs because the plugin does not properly validate URLs after following Bitly shortlink redirects within the `upload function()` method. Specifically, the `unshorten bitly url()` function follows redirects without re-validating the final destination URL, allowing attackers to potentially make the server perform HTTP requests to arbitrary internal endpoints. This could include access to localhost, private IP ranges, and cloud metadata services. An authenticated attacker with Contributor-level access or higher can exploit this issue. **Recommendations** Update to version 7.36 or later.

**Name of the Vulnerable Software and Affected Versions** WP Import – Ultimate CSV XML Importer for WordPress versions prior to 7.33.1 **Description** The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to PHP Object Injection due to the deserialization of untrusted data from CSV file imports. This occurs within the `import single post as csv` function located in the `SingleImportExport.php` file. An authenticated attacker with administrator-level access or higher can inject a PHP object. If a PHP Object Injection chain is present through another installed plugin or theme, it may allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. **Recommendations** Update WP Import – Ultimate CSV XML Importer for WordPress to a version newer than 7.33.1.

**Name of the Vulnerable Software and Affected Versions** Smart Auto Upload Images versions prior to 1.2.1 **Description** The Smart Auto Upload Images plugin for WordPress is affected by a flaw related to missing file type validation during the auto-image creation process. This allows authenticated attackers with Contributor-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution. The plugin’s auto-image creation functionality does not properly check the type of uploaded files. This allows attackers to bypass security measures and upload malicious files. **Recommendations** Versions prior to 1.2.1 should be updated to address this issue.