Description
WordPress Plugin Import XML and RSS Feeds is prone to a remote code execution vulnerability because the web shells created as a result of a previously reported issue [CVE-2023-4300] are not being deleted when updating to the new version. Successful exploitation may allow attackers to execute arbitrary commands with the privileges of the user running the application, to compromise the application or the underlying database, to access or modify data or to compromise a vulnerable system. WordPress Plugin Import XML and RSS Feeds version 2.1.4 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.1.5 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:DE2CDB38-3A9F-448E-B564-A798D1E93481
https://plugins.svn.wordpress.org/import-xml-feed/trunk/readme.txt
Related Vulnerabilities
Internet Information Services Improper Authentication Vulnerability (CVE-2009-1122)
WordPress Plugin WP Vault Local File Inclusion (0.8.6.6)
Claroline Other Vulnerability (CVE-2005-1376)
MySQL CVE-2015-0506 Vulnerability (CVE-2015-0506)
WordPress Plugin Gallery-Responsive Photo and Video Gallery by Limb Cross-Site Scripting (1.3.2)