CVE-2020-36849

published 2025-07-12

CVE-2020-36849: The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…

Priority P2 75 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ait-themes	csv_import_export	<= 3.0.3	—
ait_themes	ait_csv_import_export	<= 3.0.3	—

Detection & IOCs extracted from sources · hover to see the quote

path /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php↗

path wp-content/uploads/↗

• → The upload-handler endpoint does not require authentication; monitor for unauthenticated POST requests to /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php from any source. ↗
• → Alert on PHP files appearing in wp-content/uploads/ — this is the drop location for the webshell after a successful exploit. ↗
• → The plugin does not need to be activated for exploitation; presence of the plugin directory alone is sufficient attack surface. ↗
• → Even if the server returns a CSV parse error in the response, the uploaded PHP shell is retained on disk — do not rely on HTTP error responses as evidence of failed exploitation. ↗

• · Affects AIT CSV Import/Export plugin versions up to and including 3.0.3; versions beyond 3.0.3 are not confirmed vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434