CSV Mass Importer WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability exists in the CSV Mass Importer WordPress plugin, affecting versions through 1.2. The plugin fails to properly validate uploaded files, which allows high-privilege users, such as administrators, to upload arbitrary files to the server. This issue is particularly problematic in multisite setups, where such actions should be restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads on the server, potentially allowing for further actions such as remote code execution, depending on the nature of the uploaded files.