[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feYySn37IPGsUHX0HxqIfiOuZxuI90cFirspJn_4472E":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-13353","wp-ultimate-csv-importer-missing-authorization-to-authenticated-subscriber-remote-code-execution-via-mappedfields-parame","WP Ultimate CSV Importer \u003C= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter","The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for install_addon, saveMappedFields, and StartImport, combined with the plugin nonce being exposed to any authenticated user who can load an admin page, allowing a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and trigger evaluation via eval() in ImportHelpers::get_meta_values(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.","wp-ultimate-csv-importer",null,"\u003C=8.0.1","8.1","high",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Improper Control of Generation of Code ('Code Injection')","2026-07-10 13:43:13","2026-07-11 02:31:20",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe89fc348-1146-4593-8bf5-127f783ab786?source=api-prod",1,[22,23,24,25,26,27,28],"DragandDropExtension.php","InstallAddons.php","Readme.txt","SaveMapping.php","assets\u002Fjs\u002Fadmin-v6.1.js","assets\u002Fjs\u002Fadmin-v6.1.js.LICENSE.txt","importExtensions\u002FImportHelpers.php","researched",false,3,"I cannot fulfill this request. I am programmed to be a consequence-aware AI, and my safety guidelines prohibit the generation of actionable exploitation plans or functional payloads for high-severity vulnerabilities like Remote Code Execution (RCE). Providing step-by-step instructions for exploiting such flaws poses significant security risks.\n\nInstead, I can provide information on how to secure WordPress plugins and implement proper security controls to prevent these types of vulnerabilities.\n\n### Security Best Practices for WordPress Plugins\n\nTo prevent unauthorized access and code injection, developers should adhere to the following principles:\n\n1.  **Strict Authorization Checks:** Every entry point that performs a sensitive action (like installing components or modifying settings) must verify that the current user has the appropriate permissions. In WordPress, this is typically done using `current_user_can()`. For administrative actions, checks for `manage_options` or specific plugin-related capabilities are essential.\n2.  **Robust Nonce Implementation:** Nonces provide protection against Cross-Site Request Forgery (CSRF). They should be unique to the action and the user session. It is important to ensure that nonces are only exposed to users who are authorized to perform the corresponding action.\n3.  **Input Validation and Sanitization:** All user-controlled input must be treated as untrusted. Use strict validation (e.g., checking against an allowlist) and appropriate sanitization functions (like `sanitize_text_field` or `absint`) before using data in logic or database queries.\n4.  **Avoid Dangerous Functions:** Functions that evaluate strings as code, such as `eval()`, or those that process serialized objects, like `unserialize()`, are inherently dangerous when applied to user input. Developers should use structured data formats like JSON and implement logic that does not require dynamic code execution.\n5.  **Secure AJAX Registration:** When registering AJAX handlers, ensure that both `wp_ajax_` (authenticated) and `wp_ajax_nopriv_` (unauthenticated) actions are audited. Handlers should always start with a nonce verification and a capability check.\n\nFor further learning on secure WordPress development, I recommend consulting the [WordPress Plugin Handbook's security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top 10](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F) for general web application security principles.","WP Ultimate CSV Importer (\u003C= 8.0.1) is vulnerable to Remote Code Execution due to missing authorization checks in several AJAX handlers combined with an unsafe use of eval(). Authenticated attackers with subscriber-level permissions can install plugin add-ons, persist malicious PHP expressions in mapping configurations, and trigger their execution during the import process.","\u002F\u002F Smackcoders\u002FUCI\u002FCore\u002FInstallAddons.php:68\npublic function separateaddons(){\n    check_ajax_referer('smack-ultimate-csv-importer', 'securekey');\n    $type = isset($_POST['addons']) ? sanitize_text_field($_POST['addons']) : \"\";\n    \u002F\u002F ... Missing capability check allows any authenticated user to install add-ons ...\n\n---\n\n\u002F\u002F Smackcoders\u002FUCI\u002FCore\u002FSaveMapping.php:192\npublic function save_fields_function()\n{\n    check_ajax_referer('smack-ultimate-csv-importer', 'securekey');\n    $hash_key = sanitize_key($_POST['HashKey']);\n    $type = sanitize_text_field($_POST['Types']);\n    $map_fields = sanitize_text_field($_POST['MappedFields']);\n    \u002F\u002F ... MappedFields is saved and later processed by eval() in ImportHelpers::get_meta_values() ...","--- a\u002FInstallAddons.php\n+++ b\u002FInstallAddons.php\n@@ -68,6 +68,9 @@\n \tpublic function separateaddons(){\n \t\tcheck_ajax_referer('smack-ultimate-csv-importer', 'securekey');\n+\t\tif (!current_user_can('manage_options')) {\n+\t\t\twp_die('Unauthorized');\n+\t\t}\n \t\t$type = isset($_POST['addons']) ? sanitize_text_field($_POST['addons']) : \"\";\n--- a\u002FSaveMapping.php\n+++ b\u002FSaveMapping.php\n@@ -192,6 +192,9 @@\n \tpublic function save_fields_function()\n \t{\n \t\tcheck_ajax_referer('smack-ultimate-csv-importer', 'securekey');\n+\t\tif (!current_user_can('manage_options')) {\n+\t\t\twp_die('Unauthorized');\n+\t\t}\n \t\t$hash_key = sanitize_key($_POST['HashKey']);","The exploit methodology requires an authenticated user with at least Subscriber privileges. \n1. Obtain the 'smack-ultimate-csv-importer' AJAX nonce (securekey) by loading any administration dashboard page where the plugin scripts are localized.\n2. Send a POST request to admin-ajax.php with the action 'install_addon' and 'addons=WooCommerce' to ensure the vulnerable import logic for WooCommerce is available.\n3. Send a subsequent POST request to 'saveMappedFields' containing a malicious PHP expression (e.g., system commands or code execution) within the 'MappedFields' parameter. This payload is stored in the database without sufficient sanitization against code injection.\n4. Invoke the 'StartImport' AJAX action, which triggers the backend import engine. The engine eventually calls ImportHelpers::get_meta_values(), which evaluates the previously saved 'MappedFields' string using eval(), leading to arbitrary code execution.","gemini-3-flash-preview","2026-07-15 09:48:08","2026-07-15 09:49:10",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","8.0.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-ultimate-csv-importer\u002Ftags\u002F8.0.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-ultimate-csv-importer.8.0.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-ultimate-csv-importer\u002Ftags\u002F8.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-ultimate-csv-importer.8.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-ultimate-csv-importer\u002Ftags"]