Deserialization of untrusted data in smackcoders WP Ultimate CSV Importer – Import CSV…
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| smackcoders | WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress | up to 7.33.1 | — | No fix listed | CNA |
- WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress Vendorsmackcoders Affected up to 7.33.1 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:smackcoders:wp_ultimate_csv_importer:*:*:*:*:*:*:*:* | — | — | smackcoders |
- cpe:2.3:a:smackcoders:wp_ultimate_csv_importer:*:*:*:*:*:*:*:* Versions — — ·smackcoders
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13145
- 2026-10-03 Alias added: GHSA-fpcx-rqjq-9vj8
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5e441699-4c78-4277-8ac1-f33b810e78cb?source=cve
- https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/SingleImportExport.php#L116
- https://plugins.trac.wordpress.org/changeset/3397842/wp-ultimate-csv-importer/trunk/SingleImportExport.php
More smackcoders vulnerabilities
- TI-2022-03538 Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi CVSS 3.1HIGH 8.8
- TI-2022-02996 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi CVSS 3.1HIGH 7.2
- TI-2022-02997 Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation CVSS 3.1MEDIUM 4.2
- TI-2025-02048 Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2024-37247 WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.1
- TI-2024-29554 WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-13145 · CVE Program
- CVE-2025-13145 · NVD
- FIRST EPSS
- GHSA-fpcx-rqjq-9vj8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences