CVE-2026-13353: WP Ultimate CSV Importer RCE Vulnerability

CVE-2026-13353 Overview

CVE-2026-13353 is a Remote Code Execution (RCE) vulnerability in the WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin. All versions up to and including 8.0.1 are affected. The flaw stems from missing capability checks on the install_addon, saveMappedFields, and StartImport AJAX handlers, combined with the plugin nonce being exposed to any authenticated user who can load an admin page. Authenticated attackers with Subscriber-level access can install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and trigger evaluation via eval() in ImportHelpers::get_meta_values(). The vulnerability is classified as Code Injection [CWE-94].

Critical Impact
Authenticated Subscriber-level users can execute arbitrary PHP code on the underlying WordPress server, leading to full site compromise.

Affected Products

WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin (WordPress)
All versions up to and including 8.0.1
Deployments where the Import WooCommerce add-on can be installed via the plugin

Discovery Timeline

2026-07-11 - CVE-2026-13353 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-13353

Vulnerability Analysis

The vulnerability chains three weaknesses in the plugin's AJAX layer. The install_addon, saveMappedFields, and StartImport handlers do not enforce capability checks, so any authenticated role — including Subscriber — can invoke them. The plugin nonce required by these handlers is rendered into any admin page load, making it trivially retrievable by low-privileged users. Once obtained, the nonce satisfies the plugin's only remaining request validation.

With access to the handlers, an attacker installs the Import WooCommerce add-on through install_addon, then submits a crafted mapping via saveMappedFields. The MappedFields parameter accepts attacker-controlled strings that are persisted and later interpolated into a PHP expression passed to eval() inside ImportHelpers::get_meta_values(). Triggering StartImport executes the injected code in the WordPress process context.

Root Cause

The root cause is unsafe use of eval() on user-controlled input combined with broken access control on privileged AJAX endpoints. The handlers rely on nonce verification alone and omit current_user_can() checks, violating WordPress capability model expectations for administrative actions.

Attack Vector

Exploitation requires network access to the WordPress site and Subscriber-level authentication. The attacker loads an admin-accessible page to harvest the plugin nonce, then issues three AJAX requests: install_addon to deploy the WooCommerce add-on, saveMappedFields to store the malicious PHP payload in MappedFields, and StartImport to drive execution through ImportHelpers::get_meta_values(). No user interaction is required beyond the attacker's own session.

See the WordPress Plugin File Review of InstallAddons.php, SaveMapping.php L1562, and SaveMapping.php L185 for the affected code paths.

Detection Methods for CVE-2026-13353

Indicators of Compromise

POST requests to admin-ajax.php with action=install_addon, action=saveMappedFields, or action=StartImport originating from Subscriber or Contributor accounts.
Unexpected presence of the Import WooCommerce add-on directory under the plugin's install path on hosts where WooCommerce imports are not used.
Stored MappedFields values containing PHP syntax such as system(, passthru(, base64_decode(, or backtick execution.
New PHP files, cron jobs, or outbound connections from the www-data or PHP-FPM process shortly after StartImport calls.

Detection Strategies

Monitor WordPress access logs for low-privileged users invoking plugin AJAX actions tied to import workflows.
Perform static review of the WordPress database options and plugin storage tables for MappedFields entries containing PHP function tokens.
Alert on any invocation of eval() within ImportHelpers::get_meta_values() when application-level PHP tracing is enabled.

Monitoring Recommendations

Enable web application firewall rules that inspect admin-ajax.php bodies for the three vulnerable action parameters combined with non-administrator session cookies.
Track process lineage under the PHP interpreter to identify shell spawns following import operations.
Forward WordPress and web server logs to a centralized analytics platform and correlate authentication role with sensitive AJAX actions.

How to Mitigate CVE-2026-13353

Immediate Actions Required

Update WP Ultimate CSV Importer to the version released in changeset 3591135, which supersedes 8.0.1.
Audit WordPress user accounts and disable or remove any unexpected Subscriber-level accounts created recently.
Review the plugin's stored mappings and delete any MappedFields entries containing PHP code.
Rotate WordPress secret keys, database credentials, and any API tokens accessible to the web process.

Patch Information

The vendor addressed the issue in the plugin update referenced in changeset 3591135. The fix adds capability checks to the affected AJAX handlers and removes unsafe evaluation of stored mapping data. Full technical details are available in the Wordfence Vulnerability Report and in the plugin source references above.

Workarounds

Deactivate the WP Ultimate CSV Importer plugin until the patched version can be deployed.
Restrict new user registration and set default new-user role to a value with no admin page access.
Deploy a WAF rule that blocks admin-ajax.php requests with action values of install_addon, saveMappedFields, or StartImport unless the requester holds the manage_options capability.

bash

# Example WordPress hardening: disable open registration and lower default role
wp option update users_can_register 0
wp option update default_role subscriber

# Deactivate the vulnerable plugin until patched
wp plugin deactivate wp-ultimate-csv-importer