Remote Code Execution Risk in WP Ultimate CSV Importer Plugin by WordPress

CVE-2023-4141

Summary

The WP Ultimate CSV Importer plugin for WordPress is susceptible to a vulnerability that allows authenticated users with author-level permissions or higher to execute arbitrary PHP code on the server. This is possible through manipulating the '->cus2' parameter, provided that the administrator has granted the necessary access in the plugin settings. It is important to note that while the author of the plugin has resolved this vulnerability by restricting file imports for authors and editors, site administrators still retain the ability to create PHP files. This necessitates a cautious approach when using the plugin, as server security could still be compromised.

References