What is the CVSS score of CVE-2026-65461?

CVE-2026-65461 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Really Simple CSV Importer are affected by CVE-2026-65461?

A critical vulnerability in Really Simple CSV Importer WordPress plugin (v1.3 and below) enables authenticated administrators to upload malicious files and gain persistent server access, exposing…

How to fix or mitigate CVE-2026-65461?

Within 24 hours, audit all WordPress administrator accounts with access to Really Simple CSV Importer for suspicious activity and temporarily disable the plugin if not essential to business operations. Within 7 days, restrict administrator role assignment to essential personnel only, enforce multi-factor authentication on all administrator accounts, and implement file integrity monitoring and access controls on web-accessible upload directories. Within 30 days, maintain a staging environment to test and deploy the patched version immediately upon release by Patchstack, and evaluate alternative CSV import plugins with stronger security controls.

Really Simple CSV Importer CVE-2026-65461

EUVD-2026-48225 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-23 Patchstack

GHSA-r527-6vrg-gv55

File Upload Really Simple Csv Importer WordPress Wordpress Plugin

9.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin privileges are required (PR:H) and an uploaded shell compromises the same WordPress/host authority, so S:U not S:C; impact is high across C/I/A via code execution.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:36 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.1

DescriptionCVE.org

Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.

AnalysisAI

Arbitrary file upload in the Really Simple CSV Importer WordPress plugin (versions <= 1.3) lets an authenticated administrator write files of dangerous types into a web-accessible path, enabling web shell deployment and full site/server compromise. Reported by Patchstack, it carries a CVSS 9.1 (scope-changed) rating, but exploitation requires high privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Really Simple CSV Importer is a WordPress plugin that ingests CSV files to bulk-create or update posts, users, and attached media. The flaw is CWE-434 (Unrestricted Upload of File with Dangerous Type): the import routine accepts file references/attachments during CSV processing without adequately validating extension or MIME type against an allow-list, so a dangerous file (e.g., a PHP script) can be written into the WordPress uploads directory where it is web-servable and executable. The affected component is identified by CPE cpe:2.3:a:webの相談所:really_simple_csv_importer, indicating a Japanese-authored plugin (vendor 'Web no Soudanjo'). Because uploaded content can land in an executable web path, a benign data-import feature becomes an arbitrary-code-execution primitive.

RemediationAI

No vendor-released patch version is identified in the provided data, so exact fixed-release guidance cannot be cited - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/really-simple-csv-importer/vulnerability/wordpress-really-simple-csv-importer-plugin-1-3-arbitrary-file-upload-vulnerability) and the WordPress.org plugin page for a release newer than 1.3 and apply it once available. Because the plugin appears lightly maintained, the strongest compensating control is to deactivate and remove the plugin if CSV import is not actively needed, fully eliminating the attack surface at the cost of losing import functionality. If it must remain, restrict administrator accounts to trusted personnel and enforce 2FA to protect the PR:H prerequisite, limit who can reach the import feature, and configure the web server to deny PHP execution in wp-content/uploads (an .htaccess or nginx rule blocking script handlers) - this blocks web-shell execution but can break plugins that legitimately serve dynamic content from uploads. A Patchstack WAF/virtual-patch rule can filter malicious import requests as an interim measure.