{
 "id": "WPSEC-2026-1392",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1392/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1392/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1392/index.md",
 "title": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.1.3 - Cross-Site Request Forgery to Port Setting Update",
 "description": "The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'port' parameter in all versions up to, and including, 4.1.3, due to the base admin controller saving the 'port' option from POST data whenever 'is_settings_submitted' was present, on every WP All Import admin page, without nonce validation. This makes it possible for unauthenticated attackers to change the port the plugin uses to build its admin URLs and redirects, which can break the plugin's admin screens and import wizard, via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.",
 "plugin": {
  "slug": "wp-all-import",
  "name": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets",
  "full_name": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets",
  "wordpress_org": "https://wordpress.org/plugins/wp-all-import/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-all-import/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-all-import"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.1.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.1.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.1.4",
 "remediation": "Update to 4.1.4 or later.",
 "fix_released": "2026-10-20T17:40:34+00:00",
 "published": "2026-10-21T17:49:01+00:00",
 "updated": "2026-10-21T10:35:40.666359+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1392/",
  "https://plugins.svn.wordpress.org/wp-all-import/tags/4.1.4/",
  "https://wordpress.org/plugins/wp-all-import/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-all-import",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}