CVE-2026-125912: WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Ultimate CSV Importerto a version that resolves this vulnerability.Fixed in 9.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An Administrator of a WordPress Multisite subsite can exploit it. The attacker does not need Network Administrator privileges, plugin-install permissions, or file-editing permissions.
What conditions are required for exploitation?
The affected WP Ultimate CSV Importer plugin must be installed at a version before 9.2, and the attacker must be able to use its remote media import functionality from a Multisite subsite administrator account.
Are standalone WordPress sites affected?
The provided information specifically describes exploitation by an Administrator of a WordPress Multisite subsite in the shared WordPress context. It does not state whether standalone installations are affected.
What is the impact of successful exploitation?
A subsite administrator can write arbitrary PHP through media import and execute it in the shared WordPress context, resulting in network-wide PHP code execution.