CVE-2023-4521

Deeper analysis

The Import XML and RSS Feeds WordPress plugin before version 2.1.5 contains a web shell that was inadvertently left in the released package. The files originated from a proof-of-concept run against a prior reported issue and were not removed before the new version was published; the vendor itself was not compromised. This results in a critical vulnerability rated 9.8 on CVSS 3.1, affecting any site running an unpatched copy of the plugin.

Unauthenticated attackers with network access can directly invoke the web shell to execute arbitrary code on the underlying server, achieving full remote code execution with impacts to confidentiality, integrity, and availability. No authentication, user interaction, or special conditions are required.

The referenced WPScan advisory confirms the root cause as residual PoC artifacts and states that sites should update to version 2.1.5 or later to remove the web shell. Administrators are advised to inspect deployed instances for unexpected files matching the PoC output and to verify plugin integrity after upgrading.

The CVE carries a high exploitation probability with an EPSS score of 0.9261 (peak 0.9273), indicating substantial real-world interest following disclosure.