The AIT CSV Import/Export plugin for WordPress, a tool designed to simplify data management, has a severe security flaw. This vulnerability could allow malicious attackers to take full control of affected websites.
CVE Details
- Product: AIT CSV Import/Export plugin for WordPress
- CVE ID: CVE-2020-36849
- Published: July 12, 2025
- Severity: Critical
- Status: Analyzed
Affected Products
This critical vulnerability impacts the AIT CSV Import/Export plugin for WordPress, specifically versions up to and including 3.0.3. The flaw resides in the upload-handler.php file, which is part of the plugin’s administrative section.
Current Status
This vulnerability is currently listed with a status of “Analyzed.” This means the details of the flaw have been thoroughly investigated and confirmed by security researchers and vendors.
Severity Level
Rated as **Critical** with a CVSS score of 9.8, this vulnerability poses an extremely high risk. The core issue is an arbitrary file upload vulnerability. This allows unauthorized attackers to upload any type of file, including malicious scripts, to your website’s server. Because the plugin’s upload handler does not properly check the type of file being uploaded, attackers can bypass security measures and deposit files that could lead to remote code execution. This means an attacker could run commands on your server, potentially leading to a complete compromise of your website and server infrastructure.
Possible Solutions
If you are using the AIT CSV Import/Export plugin for WordPress, immediate action is required to protect your website.
- Update Immediately: The most crucial step is to update your AIT CSV Import/Export plugin to version 3.0.4 or higher. This version contains the necessary fixes to address the file type validation issue.
- Remove or Deactivate: If an update is not immediately feasible, consider deactivating or entirely removing the AIT CSV Import/Export plugin until you can apply the patch.
- Web Application Firewall (WAF): Implement a robust Web Application Firewall (WAF) to help detect and block malicious upload attempts.
- Regular Backups: Always maintain up-to-date backups of your website. In the event of a successful exploitation, a recent backup can significantly reduce recovery time and data loss.
- File Permissions: Ensure proper file permissions are set on your WordPress installation, especially for the
wp-content/uploads/directory, to prevent unexpected file modifications.
For more insights into securing your WordPress site, consider our posts on WordPress security best practices and Plugin security guides.
References
https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/wp_ait_csv_rce.rb
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_ait_csv_rce.rb
https://wpscan.com/vulnerability/36e699a4-91f2-426d-ba14-26036fbfeaea
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-ait-themes-csv-import-export-arbitrary-file-upload-3-0-3/
https://www.ait-themes.club/wordpress-plugins/csv-import-export/
https://www.wordfence.com/threat-intel/vulnerabilities/id/cece751c-400d-42b4-9438-950d5aca51fc?source=cve
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_ait_csv_rce.rb
