Attack Chain

1. An authenticated attacker, with subscriber-level access or higher, logs into the WordPress site.
2. The attacker loads any administrative page to retrieve the plugin's nonce, which is exposed to all authenticated users.
3. The attacker sends an AJAX request to the install_addon handler, bypassing capability checks due to the vulnerability, to install the Import WooCommerce add-on.
4. The attacker sends another AJAX request to the saveMappedFields handler, also lacking proper capability checks, to inject and persist attacker-controlled PHP expressions into the MappedFields parameter.
5. The attacker initiates an import process by sending a request to the StartImport AJAX handler.
6. The StartImport handler, lacking capability checks, processes the request, which subsequently calls ImportHelpers::get_meta_values().
7. The eval() function within ImportHelpers::get_meta_values() evaluates the previously injected PHP expressions.
8. The attacker's PHP code is executed on the server, resulting in remote code execution and full control over the compromised WordPress installation.

Impact

Successful exploitation of CVE-2026-13353 leads to arbitrary remote code execution on the affected WordPress server. This allows attackers to completely compromise the website, leading to potential data breaches, website defacement, injection of malicious content, or further penetration into the hosting environment. Organizations using the vulnerable plugin could face significant financial and reputational damage due to loss of data integrity, confidentiality, and availability. The vulnerability has a CVSS v3.1 Base Score of 8.8 (High), indicating a severe risk.

Recommendation

• Patch CVE-2026-13353 by updating the WP Ultimate CSV Importer - WordPress Import & Export for CSV, XML & Excel plugin to a version higher than 8.0.1 immediately.
• Deploy the Sigma rule "Detects CVE-2026-13353 Exploitation - RCE via WP Ultimate CSV Importer Plugin" to your SIEM for detection of exploitation attempts.
• Monitor web server logs (category webserver) for suspicious requests to admin-ajax.php containing action=install_addon, action=saveMappedFields, or action=StartImport alongside potential PHP code in the MappedFields parameter.