WordPress plugin
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 32 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High16
- Medium16
- Low0
All WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerabilities
- High8.8Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
≤8.0.1Update to 8.1
- High7.2Authenticated (Administrator+) PHP Object Injection via CSV Import
≤7.33.1Update to 7.34
- High8.87.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
7.20 – 7.28Update to 7.29
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤7.27Update to 7.28
- High7.7Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
≤7.27Update to 7.28
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤7.20Update to 7.19.1 or 7.20.1
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤7.20Update to 7.19.1 or 7.20.1
- High8.0Authenticated (Author+) Remote Code Execution
≤7.9.8Update to 7.9.9
- High7.5Sensitive Information Exposure via Directory Listing
≤7.9.8Update to 7.9.9
- High8.0Authenticated (Author+) PHP File Creation to Remote Code Execution
≤7.9.8Update to 7.9.9
- High7.2Authenticated (Administrator+) SQL Injection
≤6.5.7Update to 6.5.8
- High7.1Missing Authorization
≤6.4.1Update to 6.4.2
- High8.8Arbitrary File Upload
≤6.4.0Update to 6.4.1
- High8.8Cross-Site Request Forgery
≤5.6Update to 5.6.1
- High7.5Arbitrary File Read
≤3.7Update to 3.7.1
- High7.5Information Disclosure
<3.6.75Update to 3.6.75
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export: common questions
Does WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export have known vulnerabilities?
Yes. VulnCrest Radar lists 32 known vulnerabilities in WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export: 16 high, 16 medium. None are known to affect version null.
How do I check which version of WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerability?
CVE-2026-45440, published Oct 7, 2026: WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 - Authenticated (Administrator+) SQL Injection. Severity: Medium (CVSS 4.9).
Is any WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerability listed in CISA KEV?
No. None of the known WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export vulnerabilities is currently listed in the CISA KEV catalog.