CVE-2023-4141

CVE-2023-4141 is a Remote Code Execution vulnerability affecting the WP Ultimate CSV Importer plugin for WordPress, versions up to and including 7.9.8. This allows authenticated attackers with author-level permissions (if administrator-granted) to create and execute PHP files on the server via the '->cus2' parameter. The vulnerability has a CVSS score of 8.8 (HIGH), indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), there is limited community discussion, with one mention on GitHub. The vendor has addressed this by restricting file import capabilities for authors and editors, though administrators can still create PHP files.