What is CVE-2023-4141?

CVE-2023-4141 is a high-severity vulnerability in Smackcoders Wp Ultimate Csv Importer, classified under Code Injection. CVSS score: 8.0/10. Published 2023-08-04.

How severe is CVE-2023-4141?

High severity. CVSS v3 base score is 8.0 out of 10.

Is CVE-2023-4141 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Smackcoders Wp Ultimate Csv Importer

CVE-2023-4141

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.012 (66.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Release Notes)
security@wordfence.com (Patch)

Frequently asked questions

What is CVE-2023-4141?: CVE-2023-4141 is a high-severity vulnerability in Smackcoders Wp Ultimate Csv Importer, classified under Code Injection. CVSS score: 8.0/10. Published 2023-08-04.
How severe is CVE-2023-4141?: High severity. CVSS v3 base score is 8.0 out of 10.
Is CVE-2023-4141 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.