CVE-2024-13562
📋 TL;DR
The Import WP plugin for WordPress exposes sensitive data stored in the uploads directory to unauthenticated attackers. This vulnerability affects all WordPress sites using Import WP version 2.14.5 or earlier, allowing attackers to extract imported user data and files without authentication.
💻 Affected Systems
- Import WP – Export and Import CSV and XML files to WordPress
📦 What is this software?
Import Wp by Importwp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive user data including personally identifiable information, credentials, or proprietary business data, leading to data breaches, regulatory violations, and reputational damage.
Likely Case
Attackers will scan for vulnerable sites and extract any accessible sensitive data from the uploads directory, potentially exposing user information and imported files.
If Mitigated
With proper access controls and directory restrictions, impact is limited to non-sensitive data or prevented entirely through proper file permissions.
🎯 Exploit Status
Exploitation requires only web access to the vulnerable uploads directory path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.14.6 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3226495/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Import WP – Export and Import CSV and XML files'
4. Click 'Update Now' if available
5. Alternatively, download version 2.14.6+ from WordPress repository
6. Deactivate, delete old version, upload and activate new version
🔧 Temporary Workarounds
Restrict uploads directory access
ApacheAdd .htaccess rules to block direct access to sensitive uploads directories
# Add to .htaccess in wp-content/uploads/
Order Allow,Deny
Deny from all
Move sensitive data
allRelocate sensitive imported files outside the publicly accessible uploads directory
🧯 If You Can't Patch
- Deactivate and remove the Import WP plugin immediately
- Implement web application firewall rules to block access to sensitive upload paths
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Import WP version 2.14.5 or earlierCheck Version:
wp plugin list --name='import-wp' --field=versionVerify Fix Applied:
Verify plugin version is 2.14.6 or later and test that /wp-content/uploads/import-wp/ directories are not publicly accessible📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /wp-content/uploads/import-wp/ paths
- Multiple 200 responses for uploads directory access from single IPs
Network Indicators:
- HTTP requests to /wp-content/uploads/import-wp/* from unauthenticated sources
- Directory traversal attempts in uploads paths
SIEM Query:
source="web_logs" AND (uri_path="/wp-content/uploads/import-wp/" OR uri_path CONTAINS "/import-wp/") AND status=200 AND user_agent NOT CONTAINS "bot"