CVE-2023-7082 is a high severity (CVSS 7.2) flaw in the Import any XML or CSV File to WordPress plugin before 3.7.3. It extracts uploaded zip files into a public folder without checking file types, so an administrator could upload an executable file. Update to 3.7.3 or later.
What's affected
The record and WPScan agree that versions before 3.7.3 are affected and that 3.7.3 is the fixed version. The plugin slug is wp-all-import. WPScan lists the researcher as quangnt and the public date as 29 December 2023.
The record says high-privilege users such as administrators can use the flaw. That limits the exposure, but compromised admin accounts and lower roles granted import permissions are the usual routes.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get wp-all-import --field=version
Any version below 3.7.3 is affected. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Update the plugin:
wp plugin update wp-all-import, or use the Plugins screen. The fixed version is 3.7.3. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Check the plugin's import folder under the uploads directory for executable files such as PHP or shtml files, and remove any you did not put there.
Why it matters
The description says the plugin accepts all zip files and extracts them into a publicly accessible directory without validating the extracted file types. If an executable file lands in that folder, the web server can run it. The record lists no CWE.
Unrestricted file upload turns a file feature into a code delivery path. When a server stores a file in a web-reachable folder and does not check what kind of file it is, a script that the web server will run can end up where it can be requested. Allow lists of file types, renaming on save, and storing uploads outside the web root are the standard defenses.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Quick check
If it needs an admin, is it still a risk?
Yes. Admin accounts get phished and reused. A feature that turns admin access into server-level code execution makes any admin compromise worse.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
