The WP Ultimate CSV Importer plugin for WordPress has an insufficiently escaped file_name parameter stored in the database and later used in raw SQL queries. This flaw is a classic SQL injection (CWE‑89) that allows authenticated users with Subscriber or higher roles to append arbitrary SQL statements when a file is uploaded. The attacker can extract sensitive information or modify database contents, potentially compromising the integrity and confidentiality of the site.

The vulnerability affects the smackcoders WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress plugin, versions up to and including 7.37. It is only exploitable when the Single Import/Export option is enabled and the server is running PHP 7.x or older.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1%, suggesting a relatively low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated subscriber-level user and the plugin’s single import/export functionality, which limits the attack surface but still permits data extraction or modification. No public exploits have been reported, but the flaw remains active in all affected plugin releases.