Code injection in smackcoders WP Ultimate CSV Importer – WordPress Import & Export for…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for install_addon, saveMappedFields, and StartImport, combined with the plugin nonce being exposed to any authenticated user who can load an admin page, allowing a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and trigger evaluation via eval() in ImportHelpers::get_meta_values(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| smackcoders | WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel | up to 8.0.1 | — | No fix listed | CNA |
- WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel Vendorsmackcoders Affected up to 8.0.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13353
- 2026-10-03 Alias added: GHSA-6rrc-q62j-9g2p
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e89fc348-1146-4593-8bf5-127f783ab786?source=cve
- https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/8.0.1/wp-ultimate-csv-importer.php#L419
- https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/8.0.1/InstallAddons.php#L66
- https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/8.0.1/SaveMapping.php#L185
- https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/8.0.1/SaveMapping.php#L1562
- https://plugins.trac.wordpress.org/changeset/3591135/wp-ultimate-csv-importer
More smackcoders vulnerabilities
- TI-2022-03538 Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi CVSS 3.1HIGH 8.8
- TI-2022-02996 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi CVSS 3.1HIGH 7.2
- TI-2022-02997 Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation CVSS 3.1MEDIUM 4.2
- TI-2025-02048 Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2024-37247 WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.1
- TI-2024-29554 WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-13353 · CVE Program
- CVE-2026-13353 · NVD
- FIRST EPSS
- GHSA-6rrc-q62j-9g2p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences