WP Import Ultimate CSV XML Importer for WordPress Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the WP Import – Ultimate CSV XML Importer for WordPress plugin, affecting all versions prior to 7.29. The issue arises because the plugin's 'write_to_customfile()' function allows authenticated users with Subscriber-level access and above to inject unfiltered PHP code into a file. This injected code can then be executed remotely, leading to unauthorized code execution on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the vulnerable WordPress site is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can use the 'write_to_customfile()' function to inject PHP code into the 'customFunction.php' file. Once the code is injected, it can be executed remotely, leading to code execution on the server.

Remediation

Users are advised to update the WP Import – Ultimate CSV XML Importer for WordPress plugin to version 7.29 or a newer patched version.