The WP All Import plugin allows users to import XML, CSV, and Excel files into WordPress. The import function lacks file type validation in versions up to 3.9.3, enabling authenticated administrators to upload arbitrary files such as .phar archives. An attacker could use these uploads to execute code on the server, potentially compromising all sites that use the plugin.

WordPress sites running the WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin, up to and including version 3.9.3.

The vulnerability carries a CVSS score of 7.2, indicating a high level of severity. The EPSS score of less than 1% suggests low but non‑zero exploitation probability, and it is not yet listed in the CISA KEV catalog. Because the attack requires administrative authentication, the threat is limited to sites where an attacker has already gained such access. However, once privileged, the attacker can upload malicious files and potentially achieve remote code execution.