WP Ultimate CSV Importer CVE-2026-13353

Exploitation requires an authenticated account at Subscriber level or above (PR:L) on a site running WP Ultimate CSV Importer ≤ 8.0.1; the attacker must be able to load at least one admin page to obtain the exposed plugin nonce, then invoke the install_addon AJAX action to add the Import WooCommerce add-on, persist PHP via the MappedFields parameter through saveMappedFields, and trigger StartImport so ImportHelpers::get_meta_values() reaches eval(). The specific enabling conditions are the missing current_user_can() capability checks on the three AJAX handlers and the plugin nonce being served to any logged-in user. Limiting factors: exploitation is not fully unauthenticated - the attacker needs valid credentials, so sites that disable self-registration and tightly control accounts substantially reduce exposure; conversely, sites allowing open registration (common for WooCommerce/membership deployments) effectively lower the bar to anonymous-plus-signup. No specific platform or non-default plugin setting beyond having the plugin active is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - consistent with server-side RCE. The description corroborates every metric: exploitation is remote via admin-ajax, needs only Subscriber-level authentication (PR:L), and yields code execution. No EPSS score was provided, so widespread-exploitation probability cannot be quantified; the vulnerability is not in CISA KEV and no POC is indicated, so this is currently a high-severity, credibly-exploitable issue rather than a confirmed in-the-wild campaign. The chief limiting factor is that an attacker must first hold a valid low-privileged account - a real barrier on locked-down sites but trivial on any WordPress instance that permits open user registration (a common default for membership, comment, or WooCommerce sites), which sharply raises real-world risk. Treat as a genuine priority given the low privilege bar and full technical impact.

An attacker registers or obtains a Subscriber account on a WordPress site running the plugin, loads an admin page to harvest the exposed plugin nonce, and calls the unprotected install_addon AJAX action to install the Import WooCommerce add-on. They then submit crafted MappedFields data via saveMappedFields containing a malicious PHP expression and invoke StartImport, causing ImportHelpers::get_meta_values() to eval() the payload and execute arbitrary code on the server. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and lack of required user interaction make weaponization straightforward.