WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

This plan outlines the exploitation research for CVE-2026-1317, a SQL injection vulnerability in the WP Ultimate CSV Importer plugin.

1. Vulnerability Summary

The "WP Import – Ultimate CSV XML Importer" plugin (versions <= 7.37) is vulnerable to SQL injection because it stores a user-supplied file_name (during file upload or mapping) in the database and subsequently uses that value in raw SQL queries without proper sanitization or parameterization using $wpdb->prepare().

The vulnerability requires the "Single Import/Export" feature to be enabled, which exposes the importer UI on standard WordPress post/page editors, and the server must be running PHP < 8.0. Authenticated users with Subscriber roles can exploit this to extract sensitive data via time-based or union-based payloads injected into the filename.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Actions:
  • saveMappedFields (to store the malicious filename in the mapping configuration).
  • StartImport (to trigger the processing logic that uses the stored filename in a query).
  • download_media_log (potential direct sink).
• Vulnerable Parameter: file_name (often passed within the MappedFields JSON or via the upload process).
• Authentication: Subscriber-level access (provided the "Single Import/Export" setting is enabled).
• Precondition:
  1. Plugin version <= 7.37.
  2. PHP Version < 8.0.
  3. Setting enable_main_mode or "Single Import/Export" enabled.

3. Code Flow

1. Input Stage: A user (Subscriber) invokes the wp_ajax_saveMappedFields action defined in SaveMapping.php.
2. Storage Stage: The save_fields_function() processes $_POST['MappedFields']. In CoreFieldsImport.php, the function set_core_values extracts the featured_file_name from the post data:

   // CoreFieldsImport.php line 123
   $media_handle['media_settings']['file_name'] = isset($post_values['featured_file_name']) ? $post_values['featured_file_name'] : '';
   update_option('smack_image_options', $media_handle);
   

3. Sink Stage: When an import starts via wp_ajax_StartImport, the plugin retrieves these options. The malicious file_name is used in a raw query (likely in the MediaImport or MediaHandling extensions, not fully provided, but indicated by the vulnerability description).
4. Alternative Sink: LogManager::download_media_log processes $_POST['filename']. If the hash_key logic is bypassed or if the query building for log retrieval uses the filename