CVE-2026-13353
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
The WP Ultimate CSV Importer plugin for WordPress up to version 8.0.1 is vulnerable to Remote Code Execution via the 'MappedFields' parameter. Missing capability checks on AJAX handlers and exposure of the plugin nonce to any authenticated user allow a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in MappedFields, and trigger eval() in ImportHelpers::get_meta_values().
Risk Assessment
An attacker with subscriber-level access can execute arbitrary PHP code on the server, leading to full compromise of the WordPress site and potentially the underlying server.
Recommendation
Immediately update the WP Ultimate CSV Importer plugin to the latest available version. If no update is available, temporarily disable the plugin or restrict admin panel access to trusted users only.
Other vulnerabilities in WP Ultimate CSV Importer
See all- CVE-2026-103336Medium
The WP Ultimate CSV Importer plugin by Smackcoders Inc. contains a vulnerability involving insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This issue affects versions from n/a through 9.1.
- CVE-2026-45440High
Administrator SQL Injection in WP Ultimate CSV Importer versions up to 9.2.
- CVE-2026-80518Low
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.
- CVE-2026-80517Low
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting.
- CVE-2026-80488Medium
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
Original NVD description (English source)
The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for install_addon, saveMappedFields, and StartImport, combined with the plugin nonce being exposed to any authenticated user who can load an admin page, allowing a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and trigger evaluation via eval() in ImportHelpers::get_meta_values(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS