What the vulnerability does
01Description
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.
Explanation of Vulnerability in Simple Terms
02Summary
WP Ultimate CSV Importer versions up to 7.9.8 contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with administrator access can inject malicious code through the plugin's import functionality, affecting the confidentiality, integrity, and availability of the WordPress installation. Update to a version newer than 7.9.8 to remediate.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full site access.
Potential impact on your site
04Site Impact
A compromised admin account can execute code to steal data, modify content, or disable the site.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to WordPress.
Key dates
06Disclosure timeline
August 4, 2023
CVE published
April 8, 2026
Record updated
