Really Simple CSV Importer CVE-2026-65461

Exploitation requires an authenticated WordPress administrator (CVSS PR:H) with access to the Really Simple CSV Importer import feature; the attacker triggers the flaw by submitting a CSV import that causes a dangerous-type file (e.g., PHP) to be written to a web-servable path. Limiting factors: the plugin must be installed and activated (versions <= 1.3), the attacker must already possess administrator privileges, and code execution depends on the upload landing where the web server will execute PHP (default WordPress uploads path). No end-user interaction is needed (UI:N) and the vector is network-reachable (AV:N), but the administrator-privilege prerequisite is the primary constraint on realistic exploitation.

The signals are mixed. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C, base 9.1) reflects network-reachable, low-complexity exploitation with high C/I/A impact and a scope change, but the decisive limiter is PR:H - a WordPress administrator account is required. Administrators are already highly trusted in WordPress and can typically install plugins/themes and edit PHP, so an admin-only file upload is materially lower real-world risk than the 9.1 headline implies; the practical threat is mainly a rogue/compromised admin or a constrained multi-admin/agency setup. No EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation. No SSVC decision data was supplied. Net: a real but lower-priority hardening item versus an unauthenticated RCE - the high base score is driven by impact and scope assumptions, not ease of access.

An attacker holding WordPress administrator access - via phishing, credential reuse, or as a rogue user in a multi-admin/agency environment - invokes the plugin's CSV import with a crafted CSV that references or attaches a PHP payload, causing the plugin to write an executable script into the web-accessible uploads directory. The attacker then requests that script's URL to run arbitrary code and drop a web shell. No public POC is identified at time of analysis; the network vector with low complexity makes the upload step itself straightforward once admin access is held.