CVE-2023-4141 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution
Authenticated attackers with author permissions can create PHP files and execute code if admin grants access, requiring a plugin update.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4141?
CVE-2023-4141 is a high-severity code injection vulnerability in smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress, published on 4 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.
Weakness: CWE-94
Which versions are affected by CVE-2023-4141?
It affects 1 product.
Products include Smackcoders Wp Ultimate Csv Importer.
How do I fix CVE-2023-4141?
No fix has been published for CVE-2023-4141 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-4141 being exploited?
There is no known exploitation of CVE-2023-4141 in the wild and no public exploit code.
Other vulnerabilities in smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress
- CVE-2023-4142 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution
- CVE-2023-4139 WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing
- CVE-2023-4140 WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
Sources
Also known as GHSA-w69j-4793-jpx4.