Input validation vulnerability in WP Import – Ultimate CSV XML Importer for WordPress 7.28

The WP Import plugin for WordPress has a security vulnerability that allows attackers to run their own code on a website. This can happen in all versions up to version 7.28. The issue is caused by a function that writes PHP code to a file without filtering it first. This means that attackers with Subscriber-level access or higher can add their own PHP code to the customFunction.php file and use it to trigger remote code execution.