Description
WordPress Plugin Import XML and RSS Feeds is prone to a remote code execution vulnerability because the web shells created as a result of a previously reported issue [CVE-2023-4300] are not being deleted when updating to the new version. Successful exploitation may allow attackers to execute arbitrary commands with the privileges of the user running the application, to compromise the application or the underlying database, to access or modify data or to compromise a vulnerable system. WordPress Plugin Import XML and RSS Feeds version 2.1.4 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.1.5 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:DE2CDB38-3A9F-448E-B564-A798D1E93481
https://plugins.svn.wordpress.org/import-xml-feed/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Affiliate Power-Sales Tracking for Affiliate Marketers Cross-Site Scripting (2.2.0)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-2271)
WordPress 5.9.x Multiple Vulnerabilities (5.9 - 5.9.5)
WordPress Plugin Popup Maker-Popup for opt-ins, lead gen, & more Security Bypass (1.7.29)
Oracle Database Server CVE-2021-35576 Vulnerability (CVE-2021-35576)