CVE-2024-13562 Overview
CVE-2024-13562 affects the Import WP plugin for WordPress, a tool used to export and import CSV and XML files. The vulnerability allows unauthenticated attackers to retrieve sensitive data stored in the /wp-content/uploads/ directory. All versions up to and including 2.14.5 are affected. The flaw stems from insecure storage of imported files in a publicly accessible uploads location. Exposed data can include imported user records and local files referenced during import operations. The issue is classified under [CWE-200] Information Exposure.
Critical Impact
Unauthenticated remote attackers can extract imported user data and local files from the WordPress uploads directory without any privileges or user interaction.
Affected Products
- Import WP – Export and Import CSV and XML files plugin for WordPress
- All versions up to and including 2.14.5
- Vendor: importwp
Discovery Timeline
- 2025-01-25 - CVE-2024-13562 published to NVD
- 2025-02-04 - Last updated in NVD database
Technical Details for CVE-2024-13562
Vulnerability Analysis
The Import WP plugin processes CSV and XML files supplied by site administrators to import content into WordPress. During processing, the plugin writes source files and intermediate artifacts to /wp-content/uploads/. WordPress serves this directory directly over HTTP without authentication checks. As a result, files containing imported records remain reachable by anyone who can guess or enumerate the file path.
The vulnerability is categorized as Sensitive Information Exposure [CWE-200]. The attack requires no authentication, no user interaction, and can be performed over the network. Confidentiality is the sole impact dimension; integrity and availability remain unaffected. Wordfence catalogs the issue in its Wordfence Vulnerability Analysis.
Root Cause
The plugin stores import source files and working data in the publicly accessible uploads directory. It does not place files in a protected location, does not add .htaccess deny rules, and does not randomize filenames sufficiently to prevent enumeration. Any file written to /wp-content/uploads/ is reachable by direct URL request.
Attack Vector
An unauthenticated attacker sends HTTP GET requests to predictable paths under /wp-content/uploads/ on a target WordPress site. If an administrator has used Import WP to process CSV or XML files, the attacker can retrieve those files directly. Common targets include user export files, customer records, and content datasets that may contain email addresses, usernames, or other personally identifiable information.
No verified public exploit code has been published. The technique reduces to direct file requests against known plugin upload paths. See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2024-13562
Indicators of Compromise
- Unauthenticated HTTP GET requests targeting files under /wp-content/uploads/ with .csv, .xml, or import-related filenames.
- Repeated 200 OK responses for upload directory paths from external IP addresses not associated with normal site traffic.
- Web server access logs showing directory enumeration patterns against /wp-content/uploads/ subfolders created by the Import WP plugin.
Detection Strategies
- Review WordPress site logs for direct requests to import artifacts in /wp-content/uploads/ paths.
- Inventory installed WordPress plugins and flag any host running Import WP at version 2.14.5 or earlier.
- Scan the uploads directory for leftover CSV and XML files containing personally identifiable information.
Monitoring Recommendations
- Forward web server and WordPress audit logs to a centralized SIEM for analysis of access patterns against the uploads directory.
- Configure alerts for bulk file downloads from /wp-content/uploads/ originating from a single client IP.
- Track plugin version inventory across managed WordPress fleets to identify unpatched Import WP installations.
How to Mitigate CVE-2024-13562
Immediate Actions Required
- Update Import WP to a version later than 2.14.5 as published in the WordPress Changeset Update.
- Audit /wp-content/uploads/ and delete any residual CSV or XML files containing sensitive imported data.
- Rotate credentials for any user accounts whose data may have been present in exposed import files.
Patch Information
The vendor addressed the issue in the changeset published at plugins.trac.wordpress.org changeset 3226495. Administrators should upgrade through the WordPress plugin updater to the latest available release.
Workarounds
- Add web server rules denying direct access to CSV and XML files within /wp-content/uploads/ until patching is complete.
- Move import artifacts out of the public uploads directory to a location not served by the web server.
- Restrict access to the WordPress site via IP allowlisting or a web application firewall while remediation is in progress.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
