CVE-2023-2252

The Directorist WordPress plugin through version 7.5.3 contains a local file inclusion vulnerability in its CSV import functionality via the file parameter, which allows administrators to include and execute arbitrary files on the server. Attackers with administrator privileges can leverage this flaw to run any PHP code present in uploaded files, potentially circumventing access restrictions, stealing confidential information, or executing malicious code when seemingly harmless file types such as images are uploaded and subsequently processed.

Based on public CVE data (MITRE/NVD).