CVE-2023-4141

Summary

CVE-2023-4141 is a Remote Code Execution vulnerability affecting WP Ultimate CSV Importer plugin for WordPress. This issue allows authenticated attackers with author-level permissions or above, who have been granted access in plugin settings, to create a PHP file and execute arbitrary code on the server. The vulnerability exists in versions up to and including 7.9.8. To mitigate this risk, the plugin author has removed the file import functionality for authors and editors. However, site administrators are still able to create PHP files, so it is crucial to use the plugin with caution.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.