title: Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF
description: The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Unknown
product: Advanced Import : One Click Import for WordPress or Theme Demo Data
collectionURL: https://wordpress.org/plugins
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.3.8
defaultStatus: unaffected
}