CVE-2023-4140 WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation

Q: What is CVE-2023-4140?

CVE-2023-4140 is a medium-severity vulnerability in smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress, published on 4 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Medium 6.6 Published 4 Aug 2023 Updated 8 Apr 2026

Authenticated authors can escalate privileges to administrator by modifying user metadata if plugin access is granted.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-4140?

CVE-2023-4140 is a medium-severity vulnerability in smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress, published on 4 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter.

Weakness: CWE-269

Which versions are affected by CVE-2023-4140?

It affects 1 product.

Products include Smackcoders Wp Ultimate Csv Importer.

How do I fix CVE-2023-4140?

No fix has been published for CVE-2023-4140 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-4140 being exploited?

There is no known exploitation of CVE-2023-4140 in the wild and no public exploit code.

Sources

Also known as GHSA-w8cv-px37-3m49.