CVE-2022-2268: The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users

high Affects wp-all-import (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2022-07-04; advisory modified 2026-06-17.

The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users

Package: wp-all-import (WordPress plugin) WordPress
Affected versions: <3.6.8
Fixed in: 3.6.8
Severity: high CVSS 7.2
Exploitation: not on CISA KEV · EPSS 1% (72.7th percentile)
Published: 2022-07-04
Source: nvd

References

CWE-434

NVD record wp-all-import (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-2711 high The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the path same package: wp-all-import (WordPress plugin)
CVE-2015-9330 critical The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. same package: wp-all-import (WordPress plugin)
CVE-2022-36386 critical Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File same package: wp-all-import (WordPress plugin)
CVE-2018-0546 medium Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for Word same package: wp-all-import (WordPress plugin)
CVE-2018-0547 medium Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for Word same package: wp-all-import (WordPress plugin)
CVE-2015-9331 high The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated r same package: wp-all-import (WordPress plugin)