CVE-2023-7082: Soflyy Export Any WordPress Data To Xml/csv

High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days.

The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.

Affected products

• Soflyy Export Any WordPress Data To Xml/csv: before 3.7.3 (fixed in 3.7.3)

Published 2024-01-22. Last modified 2026-06-17.