CVE-2025-10001

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10001", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-04T17:50:53.706Z", "datePublished": "2025-09-10T06:38:50.376Z", "dateUpdated": "2026-04-08T17:18:23.155Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:23.155Z"}, "affected": [{"vendor": "wpallimport", "product": "WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible."}], "title": "Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb03aeb8-32ab-4962-bc95-b10fb7bd7fcf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3358208/wp-all-import/trunk/classes/upload.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Truong"}], "timeline": [{"time": "2025-09-05T12:25:31.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-09T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T15:42:35.300754Z", "id": "CVE-2025-10001", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T15:43:14.465Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-10T15:42:35.300754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T15:43:02.543Z"}}], "cna": {"title": "Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Quang Truong"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wpallimport", "product": "Import any XML, CSV or Excel File to WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.9.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-05T12:25:31.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-09T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb03aeb8-32ab-4962-bc95-b10fb7bd7fcf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3358208/wp-all-import/trunk/classes/upload.php"}], "descriptions": [{"lang": "en", "value": "The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-10T06:38:50.376Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10001", "state": "PUBLISHED", "dateUpdated": "2025-09-10T15:43:14.465Z", "dateReserved": "2025-09-04T17:50:53.706Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-10T06:38:50.376Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets", "vendor": "wpallimport", "versions": [{"lessThanOrEqual": "3.9.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible."}], "id": "CVE-2025-10001", "lastModified": "2026-06-17T08:27:30.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10001", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-10T15:42:35.300754Z", "version": "2.0.3"}}]}, "published": "2025-09-10T07:15:41.800", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3358208/wp-all-import/trunk/classes/upload.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb03aeb8-32ab-4962-bc95-b10fb7bd7fcf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:07:35.929015+00:00", "value": {"mitigation_remediation": ["Update the WP All Import plugin to a version that includes the file type validation fix (at least 3.9.4 or later).", "Configure the plugin settings or server file\u2011upload rules to block .phar and other dangerous file extensions if an immediate update is not possible.", "If the plugin is not critical, consider deactivating or removing it until a secure version is available."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via Unsafe File Upload"}, "threat_synthesis": {"affected_systems": "WordPress sites running the WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin, up to and including version 3.9.3.", "description_and_impact": "The WP All Import plugin allows users to import XML, CSV, and Excel files into WordPress. The import function lacks file type validation in versions up to 3.9.3, enabling authenticated administrators to upload arbitrary files such as .phar archives. An attacker could use these uploads to execute code on the server, potentially compromising all sites that use the plugin.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.2, indicating a high level of severity. The EPSS score of less than 1% suggests low but non\u2011zero exploitation probability, and it is not yet listed in the CISA KEV catalog. Because the attack requires administrative authentication, the threat is limited to sites where an attacker has already gained such access. However, once privileged, the attacker can upload malicious files and potentially achieve remote code execution."}}}}, "created": "2025-09-12T09:11:36.358269+00:00", "updated": "2026-04-21T03:15:16.331713+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpallimport", "wpallimport$PRODUCT$import_plugin"]}