What the vulnerability does
01Description
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
02Summary
WP Ultimate CSV Importer contains a vulnerability allowing authenticated users with low privileges to modify or delete site data without proper authorization checks. An attacker with a basic user account can manipulate CSV import functionality to alter database records or disable site features. This affects all versions up to 7.27. Site administrators should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Modify or delete site data and disable functionality via CSV import without proper authorization.
Potential impact on your site
04Site Impact
Site data integrity compromised; unauthorized changes to posts, users, or settings; potential site downtime.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
September 17, 2025
CVE published
April 8, 2026
Record updated
