The vulnerability results from missing capability checks on AJAX handlers combined any authenticated user who can load an admin page. An attacker who has at least subscriber‑level access can supply attacker‑controlled PHP expressions through the MappedFields parameter, which are later evaluated by eval() in ImportHelpers::get_meta_values(). This is a CWE‑94 code injection flaw that allows an authenticated attacker to execute arbitrary code with the permissions of the web server process.

Smack 8.0.1 or earlier on WordPress sites is affected. These sites are vulnerable if the WP Ultimate CSV Importer plugin is installed and the AJAX handlers for install_addon, saveMappedFields, and StartImport are available.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of <1% shows a very low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Nevertheless, the attack vector requires authenticated access; any user with subscriber or higher privileges can exploit this flaw by triggering eval() through a crafted request. The impact is complete code execution on the server, granting an attacker full control over the WordPress installation and any underlying infrastructure.