WordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

A successful CSRF attack could allow an attacker to manipulate the Movies Bulk Importer plugin without the user's knowledge or consent. This could involve adding malicious movie entries, modifying existing movie details (e.g., changing ratings, descriptions, or links), or even deleting legitimate movie data. The impact is amplified if the plugin is used in a high-traffic website or if it integrates with other critical systems. While the direct impact is limited to the plugin's functionality, a compromised plugin could be a stepping stone for further attacks on the WordPress site itself, particularly if other vulnerabilities exist.

Websites utilizing the AA-Team Wordpress Movies Bulk Importer plugin, particularly those with a large user base or that handle sensitive movie data, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'AA-Team Movies Bulk Importer' /var/www/html/
wp plugin list | grep 'Movies Bulk Importer'

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=movies_bulk_importer_action&param=malicious_param | grep -i 'csrf token'

1. 2026-01-22Disclosure

   disclosure

1. Reserviert2026-01-07
2. Veröffentlicht2026-01-22
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

As a fix is not yet available, immediate mitigation strategies are crucial. Implement strict input validation on all user-supplied data within the plugin to prevent malicious payloads. Consider using a Web Application Firewall (WAF) with CSRF protection rules to block suspicious requests. Additionally, enforce strong password policies and encourage users to enable two-factor authentication on their WordPress accounts. Regularly review and audit plugin configurations to identify any potential weaknesses. Once a patched version is released, upgrade immediately and verify the fix by attempting a CSRF attack using a known payload.