CVE-2026-13353 is a remote code execution vulnerability in the WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin affecting all versions up to 8.0.1. The vulnerability arises from missing capability checks on AJAX handlers (install_addon, saveMappedFields, StartImport) and exposure of the plugin nonce to any authenticated user who can load an admin page. This allows an attacker with subscriber-level privileges to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and execute them via eval() in ImportHelpers::get_meta_values(), leading to arbitrary code execution on the server.

An authenticated attacker with subscriber-level access can execute arbitrary PHP code on the server hosting the WordPress site. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The CVSS score of 8.8 reflects high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access and avoid installing or using the affected plugin versions. Monitor vendor channels for updates and apply patches promptly once available.