WP Manifestindependent plugin directory
manifest / content / csv-to-wp

CSV to WP WP RegistryMedium-severity findings · 1 findingOpen the reportB

A CSV importer plugin for Wordpress

by Beee · github.com/beee4life/csv-to-wp · website

★ 2stars
0.10latest · 3mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/beee4life/csv-to-wp/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/beee4life/csv-to-wp ↗

CSV Importer

Welcome to the CSV importer plugin for Wordpress.

It is still being developed but that won't hurt its usage. Everything works.

Description

This plugin gives you the option to import CSV data through file import and stores it in a custom table or in post/user meta table.

Installation

  • Upload the zip through WordPress plugin admin or
  • Upload the files by ftp to wp-content/plugins.
  • Activate the plugin CSV to WP through the plugins page.

Usage

  • Upload CSV data through file upload
  • Verify it
  • Preview it
  • Import it

Actions

These actions are available:

  • csv2wp_successful_csv_upload
  • csv2wp_successful_csv_import

Filters

These filters are available:

  • csv2wp_import_options (array)
  • csv2wp_delimiter (string)
  • csv2wp_line_length (int)
  • csv2wp_upload_folder (string)

FAQ

Can I import posts and other WordPress data with it ?

No, not right now. There are other plugins which do that like WordPress Importer. Maybe in the future but now there are no plans for it.

Releases

7 releases.

Tag
Published
0.10 latest
Jun 25, 2026 3mo ago
0.9
Jun 23, 2026 4mo ago
0.6
Apr 19, 2026 6mo ago
0.5
Apr 16, 2026 6mo ago
0.4
Apr 16, 2026 6mo ago
0.3
Feb 23, 2026 8mo ago
0.1
Sep 7, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

CSV to WP 0.10.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.10.0
Findings
1
Worst severity
medium
Content hash
cb1537146a5ff4ac4ee14b3f…

Findings

  • medium Import-role settings saved without capability check; role can be lowered to read

    missing_capability

    csv2wp_settings_page_functions runs on admin_init. After wp_verify_nonce only, it update_option('csv2wp_import_role', ...) from POST csv2wp_select_cap. The settings UI enumerates all administrator role capabilities including 'read'. Combined with menus/pages that authorize solely via that option, an admin CSRF or an already-lowered role allows low-privileged users to import CSV into post/user meta.

    CSV2WP.php:401-420,431-442

    Recommendation

    Require current_user_can('manage_options') before saving settings; allowlist high privileges only (manage_options, edit_others_posts, etc.); never offer 'read'.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →