CVE-2026-13353 is a high-severity vulnerability in the WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin. The flaw arises from missing capability checks on AJAX handlers (install_addon, saveMappedFields, StartImport) combined with the plugin nonce being accessible to any authenticated user who can load an admin page. This allows a subscriber-level attacker to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the 'MappedFields' parameter, and cause these expressions to be evaluated via eval() in the ImportHelpers::get_meta_values() function, resulting in remote code execution on the server. The vulnerability affects all versions up to and including 8.0.1. No official patch or remediation has been confirmed at this time.

An authenticated attacker with subscriber-level privileges can execute arbitrary PHP code on the server hosting the vulnerable WordPress plugin. This can lead to full compromise of the web server, including data theft, site defacement, or further pivoting within the network. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access and consider disabling or removing the WP Ultimate CSV Importer plugin if not essential. Monitor for updates from the vendor smackcoders and apply patches promptly once available.