title: Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
description: The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
vendor: Unknown
product: Import XML and RSS Feeds
versions:
status: affected, versionType: custom, version: 2.1.4, lessThan: 2.1.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}