WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.1.3 - Cross-Site Request Forgery to Port Setting Update
- ID
- WPSEC-2026-1392
- Plugin
- WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets (wp-all-import)
- Affected
- all versions before 4.1.4
- Remediation
- Update to 4.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets on WPSec AttackSurface
- Fix released
- Published
Description
The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'port' parameter in all versions up to, and including, 4.1.3, due to the base admin controller saving the 'port' option from POST data whenever 'is_settings_submitted' was present, on every WP All Import admin page, without nonce validation. This makes it possible for unauthenticated attackers to change the port the plugin uses to build its admin URLs and redirects, which can break the plugin's admin screens and import wizard, via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1392/
- https://plugins.svn.wordpress.org/wp-all-import/tags/4.1.4/
- https://wordpress.org/plugins/wp-all-import/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS