The CSV Me WordPress plugin has been found to allow authenticated users with Administrator-level access to upload arbitrary files to the server. This flaw arises from insufficient file type validation in the csv_me_options_page function in all versions up to and including 2.0. An attacker who can upload files may select a malicious payload such as a PHP script, potentially leading to full remote code execution, data theft, or site defacement.

All WordPress installations that use CSV Me version 2.0 or earlier are at risk. The plugin, provided by scottyla via the WordPress plugin repository, typically runs within a WordPress site where administrators have editing privileges. No specific WordPress core or server version constraints are listed, but the vulnerability exists whenever the vulnerable plugin version is active.

The CVSS score of 7.2 indicates a medium‑to‑high severity, reflecting the need for privileged access and the possibility of remote code execution. The EPSS score of 1% suggests that while the overall probability of exploitation in the wild is low, it is not negligible. The vulnerability is not currently listed in CISA’s KEV catalog, meaning there are no known large‑scale exploit campaigns at this time. The likely attack vector requires an administrator or higher role within the WordPress site to upload a file, after which the attacker can potentially trigger execution of the uploaded content on the server.