CVE-2023-4142

🗓️ 04 Aug 2023 02:04:30Reported by WordfenceType

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. Authenticated attackers with author-level permissions or above can execute code on the server. The author resolved this by removing the ability for authors and editors to import files

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-4142	4 Aug 202307:45	–	circl
CNNVD	WordPress plugin WP Ultimate CSV Importer Code Injection Vulnerability	4 Aug 202300:00	–	cnnvd
Cvelist	CVE-2023-4142 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution	4 Aug 202302:04	–	cvelist
EUVD	EUVD-2023-54023	3 Oct 202520:07	–	euvd
NVD	CVE-2023-4142	4 Aug 202303:15	–	nvd
OSV	CVE-2023-4142	4 Aug 202303:15	–	osv
Patchstack	WordPress WP Ultimate CSV Importer Plugin <= 7.9.8 is vulnerable to Remote Code Execution (RCE)	3 Aug 202300:00	–	patchstack
Prion	Remote code execution	4 Aug 202303:15	–	prion
Positive Technologies	PT-2023-27942 · WordPress · Wp Ultimate Csv Importer	4 Aug 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-4142	9 Jan 202608:56	–	redhatcve

NVD

Vulners

Node

smackcoders wp_ultimate_csv_importerRange≤7.9.8wordpress

[
  {
    "vendor": "smackcoders",
    "product": "WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "7.9.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/db1bad2e-55df-40c5-9a3f-651858a19b42
plugins	www.plugins.trac.wordpress.org/changeset/2944635/wp-ultimate-csv-importer/trunk/wp-ultimate-csv-importer.php
plugins	www.plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php

17 Jun 2026 06:37Current

9High risk

Vulners AI Score9

CVSS 3.18 - 8.8

EPSS0.01239

SSVC

CWE-94