Vulnerabilities / WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export / WPSEC-2026-2489
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.3 - Authenticated (Contributor+) CSV Injection via Single Post Export
Medium 5.4
CWE-1236Fixed in 9.3.1
- ID
- WPSEC-2026-2489
- Plugin
- WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export (wp-ultimate-csv-importer)
- Affected
- from 7.14 before 9.3.1
- Remediation
- Update to 9.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export on WPSec AttackSurface
- Fix released
- Published
Description
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to CSV Injection via the single post export feature in all versions up to, and including, 9.3, due to insufficient neutralization of formula elements in exported post fields and post meta values. This makes it possible for authenticated attackers, with contributor-level access and above, to embed spreadsheet formulas in post titles, content, excerpts or custom fields. The formulas could run on a user's local system when an administrator exports that post and opens the CSV file in a spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-2489/
- https://plugins.svn.wordpress.org/wp-ultimate-csv-importer/tags/9.3.1/
- https://wordpress.org/plugins/wp-ultimate-csv-importer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS