The vulnerability is caused by a lack of file type validation in the import_single_post_as_csv() routine, allowing an authenticated user with a Subscriber role or higher to upload any file to the site’s server. Once a file is stored, the attacker can potentially execute code on the server, creating a path to full compromise. This flaw maps to CWE‑434, an untrusted upload weakness with high confidentiality, integrity, and availability impact.

WordPress sites that use the "WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress" plugin in any version up to and including 7.19 are affected. The flaw was inadvertently reintroduced in version 7.20, but was corrected again in 7.20.1. Sites using these versions and granting Subscriber access or higher to any user must consider the potential risk.

The CVSS score of 8.8 indicates a high severity with an estimated loss of confidentiality and integrity and a possibility of non‑availability. The EPSS score of 1% signals that while the exploitation probability is low, it is still plausible. The plug‑in is not listed in the CISA KEV catalog. The likely attack vector requires login credentials and relies on the website’s permission hierarchy; a user with Subscriber or above can use the import feature to successfully upload a malicious file.