The vulnerability arises from the use of eval() on unsanitized user input within the pmxi_if function of the WP All Import plugin. This allows an authenticated attacker who has import privileges, such as an administrator, to craft import templates that contain arbitrary PHP code. When the import process evaluates the template, the injected code is executed on the server, granting the attacker full control over the affected WordPress installation.

The flaw affects the WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin, in all released versions up to and including 3.9.6. No later releases are listed as vulnerable, so sites running 3.9.7 or newer are presumed safe.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is not yet widespread but still possible. Because the issue requires authenticated administrator access, the risk is limited to sites with weak account controls or excessive admin privileges. The remote code execution payload can be delivered via a crafted import file, and the plugin’s lack of input validation makes the exploit straightforward for an insider or a compromised admin account. Sites are not listed in the CISA KEV catalog, but the functionality provides a direct code execution path that should be mitigated promptly.