What the vulnerability does
01Description
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Explanation of Vulnerability in Simple Terms
02Summary
WP Ultimate CSV Importer allows authenticated users to upload files without proper validation, enabling them to upload malicious files to the site. An attacker with low-level WordPress access can exploit this to upload executable code or other dangerous files. This affects all versions up to 7.19. Update to a version newer than 7.19 to resolve the issue.
What an attacker can do
03Attacker Capabilities
Upload malicious files (PHP, executables, etc.) to the WordPress site and potentially run code.
Potential impact on your site
04Site Impact
Malicious files uploaded via the plugin could compromise your site, steal data, or allow full takeover.
Conditions required to exploit
05Prerequisites
Attacker must have a low-level WordPress user account (subscriber or higher).
Key dates
06Disclosure timeline
April 1, 2025
CVE published
April 8, 2026
Record updated
