Import any XML or CSV File to WordPress <= 3.2.3 - RCE

WP All Import does not properly verify that a user has permission to execute functions. Coupled with an interesting method that allows arbitrary functions in specific objects to be called allows this to be leveraged in many ways.