PT-2025-29320

CVE-2020-36849

·

Published

2020-11-13

·

Updated

2026-03-04

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: AIT CSV import/export plugin for WordPress versions up to and including 3.0.3
Description: The AIT CSV import/export plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file. This allows unauthorized attackers to upload arbitrary files to the affected server, potentially leading to remote code execution.
Recommendations: Versions prior to 3.0.4: Update the AIT CSV import/export plugin to a version later than 3.0.3.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2020-36849
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com