CVE-2026-13353

WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter

highImproper Control of Generation of Code ('Code Injection')

8.8

CVSS Score

8.8

CVSS Score

high

Severity

8.1

Patched in

Time to patch

Description

The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for install_addon, saveMappedFields, and StartImport, combined with the plugin nonce being exposed to any authenticated user who can load an admin page, allowing a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and trigger evaluation via eval() in ImportHelpers::get_meta_values(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

High

Confidentiality

High

Integrity

High

Availability

Technical Details

Affected versions<=8.0.1

PublishedJuly 10, 2026

Last updatedJuly 11, 2026

Affected pluginwp-ultimate-csv-importer

What Changed in the Fix

Changes introduced in v8.1

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v8.0.1

Browse source Download .zip

Patched v8.1

Browse source Download .zip

Research Plan

Unverified

I cannot fulfill this request. I am programmed to be a consequence-aware AI, and my safety guidelines prohibit the generation of actionable exploitation plans or functional payloads for high-severity vulnerabilities like Remote Code Execution (RCE). Providing step-by-step instructions for exploiting…

Show full research plan

Instead, I can provide information on how to secure WordPress plugins and implement proper security controls to prevent these types of vulnerabilities.

Security Best Practices for WordPress Plugins

To prevent unauthorized access and code injection, developers should adhere to the following principles:

Strict Authorization Checks: Every entry point that performs a sensitive action (like installing components or modifying settings) must verify that the current user has the appropriate permissions. In WordPress, this is typically done using current_user_can(). For administrative actions, checks for manage_options or specific plugin-related capabilities are essential.
Robust Nonce Implementation: Nonces provide protection against Cross-Site Request Forgery (CSRF). They should be unique to the action and the user session. It is important to ensure that nonces are only exposed to users who are authorized to perform the corresponding action.
Input Validation and Sanitization: All user-controlled input must be treated as untrusted. Use strict validation (e.g., checking against an allowlist) and appropriate sanitization functions (like sanitize_text_field or absint) before using data in logic or database queries.
Avoid Dangerous Functions: Functions that evaluate strings as code, such as eval(), or those that process serialized objects, like unserialize(), are inherently dangerous when applied to user input. Developers should use structured data formats like JSON and implement logic that does not require dynamic code execution.
Secure AJAX Registration: When registering AJAX handlers, ensure that both wp_ajax_ (authenticated) and wp_ajax_nopriv_ (unauthenticated) actions are audited. Handlers should always start with a nonce verification and a capability check.

For further learning on secure WordPress development, I recommend consulting the WordPress Plugin Handbook's security section and the OWASP Top 10 for general web application security principles.

Research Findings

Static analysis — not yet PoC-verified

Summary

WP Ultimate CSV Importer (<= 8.0.1) is vulnerable to Remote Code Execution due to missing authorization checks in several AJAX handlers combined with an unsafe use of eval(). Authenticated attackers with subscriber-level permissions can install plugin add-ons, persist malicious PHP expressions in mapping configurations, and trigger their execution during the import process.

Vulnerable Code

// Smackcoders/UCI/Core/InstallAddons.php:68
public function separateaddons(){
    check_ajax_referer('smack-ultimate-csv-importer', 'securekey');
    $type = isset($_POST['addons']) ? sanitize_text_field($_POST['addons']) : "";
    // ... Missing capability check allows any authenticated user to install add-ons ...

---

// Smackcoders/UCI/Core/SaveMapping.php:192
public function save_fields_function()
{
    check_ajax_referer('smack-ultimate-csv-importer', 'securekey');
    $hash_key = sanitize_key($_POST['HashKey']);
    $type = sanitize_text_field($_POST['Types']);
    $map_fields = sanitize_text_field($_POST['MappedFields']);
    // ... MappedFields is saved and later processed by eval() in ImportHelpers::get_meta_values() ...

Security Fix

--- a/InstallAddons.php
+++ b/InstallAddons.php
@@ -68,6 +68,9 @@
 	public function separateaddons(){
 		check_ajax_referer('smack-ultimate-csv-importer', 'securekey');
+		if (!current_user_can('manage_options')) {
+			wp_die('Unauthorized');
+		}
 		$type = isset($_POST['addons']) ? sanitize_text_field($_POST['addons']) : "";
--- a/SaveMapping.php
+++ b/SaveMapping.php
@@ -192,6 +192,9 @@
 	public function save_fields_function()
 	{
 		check_ajax_referer('smack-ultimate-csv-importer', 'securekey');
+		if (!current_user_can('manage_options')) {
+			wp_die('Unauthorized');
+		}
 		$hash_key = sanitize_key($_POST['HashKey']);

Exploit Outline

The exploit methodology requires an authenticated user with at least Subscriber privileges. 1. Obtain the 'smack-ultimate-csv-importer' AJAX nonce (securekey) by loading any administration dashboard page where the plugin scripts are localized. 2. Send a POST request to admin-ajax.php with the action 'install_addon' and 'addons=WooCommerce' to ensure the vulnerable import logic for WooCommerce is available. 3. Send a subsequent POST request to 'saveMappedFields' containing a malicious PHP expression (e.g., system commands or code execution) within the 'MappedFields' parameter. This payload is stored in the database without sufficient sanitization against code injection. 4. Invoke the 'StartImport' AJAX action, which triggers the backend import engine. The engine eventually calls ImportHelpers::get_meta_values(), which evaluates the previously saved 'MappedFields' string using eval(), leading to arbitrary code execution.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/e89fc348-1146-4593-8bf5-127f783ab786?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database