# WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.3 - Authenticated (Contributor+) CSV Injection via Single Post Export

- **ID:** WPSEC-2026-2489
- **Plugin:** WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export (`wp-ultimate-csv-importer`), https://wordpress.org/plugins/wp-ultimate-csv-importer/
- **Affected versions:** from 7.14 before 9.3.1
- **Fixed in:** 9.3.1 (Update to 9.3.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-ultimate-csv-importer
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2489/

## Description

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to CSV Injection via the single post export feature in all versions up to, and including, 9.3, due to insufficient neutralization of formula elements in exported post fields and post meta values. This makes it possible for authenticated attackers, with contributor-level access and above, to embed spreadsheet formulas in post titles, content, excerpts or custom fields. The formulas could run on a user's local system when an administrator exports that post and opens the CSV file in a spreadsheet application.

## References

- https://wpsec.com/vuln/WPSEC-2026-2489/
- https://plugins.svn.wordpress.org/wp-ultimate-csv-importer/tags/9.3.1/
- https://wordpress.org/plugins/wp-ultimate-csv-importer/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2489/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.