The WP Ultimate CSV Importer plugin is vulnerable to PHP Object Injection via the import_single_post_as_csv function. An attacker with administrator‑level access can supply a crafted CSV file that is deserialized, allowing the injection of a PHP object. This flaw, classified as CWE‑502, can lead to the deletion of arbitrary files, retrieval of sensitive data, or execution of arbitrary code if a PHP object property chain is present.

WordPress sites running the WP Ultimate CSV Importer plugin (developed by smackcoders) version 7.33.1 or older are affected. Any installation of this plugin with administrator‑level or higher privileges is at risk.

The CVSS score is 7.2, indicating a high severity. The EPSS score is below 1%, suggesting low to moderate likelihood of exploitation but still significant. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with administrator role to upload a malicious CSV file; if a PHP object property chain exists in another plugin or theme, the attacker can perform file deletions, data exfiltration, or arbitrary code execution.