Import any XML, CSV or Excel File to WordPress < 4.0.0 - Admin+ Remote Code Execution via Conditional Logic

Description

The plugin is vulnerable to Remote Code Execution due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.