CVE-2026-103336
MediumCVSS 5.3Summary
The WP Ultimate CSV Importer plugin by Smackcoders Inc. contains a vulnerability involving insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This issue affects versions from n/a through 9.1.
Risk Assessment
An attacker may gain access to sensitive data embedded in sent data, potentially compromising confidentiality of information stored in WordPress.
Recommendation
Update the WP Ultimate CSV Importer plugin to the latest patched version. Also restrict access to CSV import functionality.
Other vulnerabilities in WP Ultimate CSV Importer
See all- CVE-2026-80488Medium
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
- CVE-2026-13353High
The WP Ultimate CSV Importer plugin for WordPress up to version 8.0.1 is vulnerable to Remote Code Execution via the 'MappedFields' parameter. Missing capability checks on AJAX handlers and exposure of the plugin nonce to any authenticated user allow a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in MappedFields, and trigger eval() in ImportHelpers::get_meta_values().
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS