WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import

Description

The plugin does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.