Description
WordPress Plugin Import XML and RSS Feeds is prone to a remote code execution vulnerability because the web shells created as a result of a previously reported issue [CVE-2023-4300] are not being deleted when updating to the new version. Successful exploitation may allow attackers to execute arbitrary commands with the privileges of the user running the application, to compromise the application or the underlying database, to access or modify data or to compromise a vulnerable system. WordPress Plugin Import XML and RSS Feeds version 2.1.4 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.1.5 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:DE2CDB38-3A9F-448E-B564-A798D1E93481
https://plugins.svn.wordpress.org/import-xml-feed/trunk/readme.txt
Related Vulnerabilities
e107 Other Vulnerability (CVE-2010-2098)
WordPress Plugin SCORM Cloud For WordPress 'ajax.php' SQL Injection (1.0.6.6)
WordPress Improper Input Validation Vulnerability (CVE-2013-4339)
WordPress Plugin HDW Player (Video Player & Video Gallery) SQL Injection (2.4.2)
WordPress Plugin Backup & Restore Dropbox Multiple Vulnerabilities (1.4.7.5)