WP Ultimate CSV Importer: Maximum-Severity RCE (CVSS 10.0)

Introduction

WP Ultimate CSV Importer had a remote code execution vulnerability disclosed with a maximum CVSS score of 10.0 — the highest possible rating, reserved for flaws that are both trivially exploitable and give an attacker complete control. This plugin is widely used to bulk-import products, posts, and users from CSV files, which means the vulnerable code path is often reachable without special configuration.

What You Should Do Right Now

1. Check if this plugin is installed under Plugins in wp-admin, even if you only used it once during a migration and forgot about it.
2. Back up your site immediately before touching anything else.
3. Update to the latest version the moment you confirm it’s installed and outdated.
4. If you’re not actively using it, deactivate and remove it. A CSV importer sitting dormant after a one-time migration is a common source of exactly this kind of forgotten, unpatched exposure.

Why “Rarely Used” Plugins Are a Blind Spot

Import/export tools are frequently installed for a single task — a migration, a bulk product upload — and then left in place indefinitely. They stop showing up in anyone’s mental checklist of “plugins I need to watch,” which is exactly why a maximum-severity bug in one can sit unpatched far longer than a bug in a plugin you use daily. If you can’t remember the last time you used it, that’s a signal to update or remove it, not to leave it be.

FAQ

What makes a vulnerability “CVSS 10.0”?
It means the flaw requires no authentication, no user interaction, and gives an attacker full impact (confidentiality, integrity, and availability) — effectively the worst-case combination.

I don’t remember installing this plugin — could it still be active?
Yes. Check your full plugin list, including inactive ones, since some vulnerabilities can be triggered even without activation depending on how the flaw works.

Is removing safer than updating?
If you don’t need the functionality anymore, removal eliminates the risk entirely rather than depending on you catching every future update.

Conclusion

A perfect 10.0 severity score doesn’t leave room for “update when convenient.” Check your plugin list today, and don’t let a one-time import tool become a permanent open door.