CSRF in Smackcoders Import All Pages\, Post Types\, Products\, Orders\, And Users As Xml \& Csv
CVE-2015-10125
A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.004 (28.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Smackcoders Import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv
- N/a Wp Ultimate Csv Importer Plugin — versions 3.7.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, permissions-required, Third Party Advisory)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (Release Notes, patch)
Frequently asked questions
- What is CVE-2015-10125?
- CVE-2015-10125 is a medium-severity vulnerability in Smackcoders Import All Pages\, Post Types\, Products\, Orders\, And Users As Xml \& Csv, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2023-10-05.
- How severe is CVE-2015-10125?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2015-10125 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.