WordPress Plugin Vulnerabilities

Import users from CSV with meta < 1.14.2.2 - CSRF leading to attachment deletion & Path Traversal

Description

CSRF leading to attachment deletion via the acui_delete_attachment() AJAX function.

Affects Plugins

Plugin icon
import-users-from-csv-with-meta
Fixed in 1.14.2.2

References

CVE
CVE-2019-15326
CVE
CVE-2019-14683
URL
https://plugins.trac.wordpress.org/changeset?reponame=&new=2112013%40import-users-from-csv-with-meta&old=2104143%40import-users-from-csv-with-meta

Miscellaneous

Verified
No
WPVDB ID
89a1fe94-ed2a-4314-a725-4a0d957d91a2

Timeline

Publicly Published
2019-06-22 (about 6 years ago)
Added
2019-06-26 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2016-07-19
Title
Icegram <= 1.9.18 - Cross-Site Request Forgery (CSRF) & XSS
Published
2014-04-25
Title
iMember360is 3.9.001 - XSS / Disclosure / Code Execution
Published
2015-02-28
Title
CP Multi View Event Calendar <= 1.1.4 - SQL Injection & XSS
Published
2015-10-15
Title
Events Made Easy < 1.5.50 - Multi CSRF to Stored Cross-Site Scripting & Event Deletion
Published
2014-12-31
Title
twitterDash 2.1 - CSRF & XSS