WP Ultimate CSV Importer Flaws Expose 20,000 Websites to Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-2007 | The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the d The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1. NVD description · AI analysis pending | 8.1 | 1% |
| — | ||
| CVE-2025-2008 | The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_ The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1. NVD description · AI analysis pending | 8.8 | 1% |
| — |
Full article314 words · extracted from infosecurity-magazine.com · click to collapse
Two high-risk security vulnerabilities in the WP Ultimate CSV Importer plugin for WordPress have been discovered by security researchers.
These flaws, potentially affecting over 20,000 websites, allow authenticated users with subscriber-level access or higher to upload arbitrary files and delete critical site files, enabling attackers to achieve complete site compromise.
The vulnerabilities, an arbitrary file upload and an arbitrary file deletion flaw, affect versions up to 7.19 of WP Ultimate CSV Importer. According to a new advisory by Wordfence, attackers exploiting these flaws can achieve remote code execution or force a site into a compromised setup state.
The arbitrary file upload vulnerability (CVE-2025-2008) has a CVSS score of 8.8. The flaw stems from the import_single_post_as_csv() function of the CSV Importer plugin, which lacks proper file type validation allowing attackers to upload malicious PHP files that can execute code remotely and potentially lead to full site takeover.
Meanwhile, the arbitrary file deletion flaw (CVE-2025-2007) has a CVSS score of 8.1. In this case, the deleteImage() function lacks sufficient file path validation, enabling attackers to delete arbitrary files, including wp-config.php, which forces a site reset and allows hijacking of the setup process.
These vulnerabilities were reported through the Wordfence Bug Bounty Program by researcher “mikemyers.” Wordfence disclosed the vulnerabilities to the plugin’s developers, Smackcoders, on March 5 2025.
The vendor acknowledged the report on March 7, and a fully patched version, 7.19.1, was released on March 25 2025.
“We encourage WordPress users to verify that their sites are updated to the latest patched version of WP Ultimate CSV Importer as soon as possible considering the critical nature of these vulnerabilities,” Wordfence said.
Given the severity of these security flaws, website administrators should verify that their installations are up to date.
Image credit: Primakov / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/wp-ultimate-csv-importer-flaws/