CVE-2025-10051

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10051", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-05T18:59:18.230Z", "datePublished": "2025-10-15T08:25:54.412Z", "dateUpdated": "2026-04-08T16:49:46.913Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:46.913Z"}, "affected": [{"vendor": "themeinwp", "product": "Demo Import Kit", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/465f2fd1-9eb3-43ca-8acc-74acf6bcde1a?source=cve"}, {"url": "https://wordpress.org/plugins/demo-import-kit/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Le Cong Danh"}], "timeline": [{"time": "2025-10-14T19:38:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-15T19:45:42.915055Z", "id": "CVE-2025-10051", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T19:45:51.492Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10051", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-15T19:45:42.915055Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T19:45:47.917Z"}}], "cna": {"title": "Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Le Cong Danh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "themeinwp", "product": "Demo Import Kit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T19:38:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/465f2fd1-9eb3-43ca-8acc-74acf6bcde1a?source=cve"}, {"url": "https://wordpress.org/plugins/demo-import-kit/"}], "descriptions": [{"lang": "en", "value": "The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:46.913Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10051", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:49:46.913Z", "dateReserved": "2025-09-05T18:59:18.230Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T08:25:54.412Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Demo Import Kit", "vendor": "themeinwp", "versions": [{"lessThanOrEqual": "1.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin Demo Import Kit para WordPress es vulnerable a subidas arbitrarias de archivos debido a la falta de validaci\u00f3n del tipo de archivo en todas las versiones hasta la 1.1.0, inclusive, a trav\u00e9s de la funcionalidad de importaci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, suban archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-10051", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10051", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-15T19:45:42.915055Z", "version": "2.0.3"}}]}, "published": "2025-10-15T09:15:36.850", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/demo-import-kit/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/465f2fd1-9eb3-43ca-8acc-74acf6bcde1a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:08:07.735905+00:00", "value": {"mitigation_remediation": ["Upgrade the Demo Import Kit plugin to the latest available version or a patch that includes file type validation", "If an update is not possible, remove or disable the import functionality entirely to eliminate the upload vector", "Implement additional server\u2011side checks to allow only trusted file types and monitor the upload directory for unauthorized files"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of the Demo Import Kit plugin from the themeinwp vendor, specifically any version up to and including 1.1.0.", "description_and_impact": "The Demo Import Kit plugin for WordPress suffers from missing file type validation that permits the upload of any file through its import feature. This flaw is a classic example of CWE\u2011434. An authenticated attacker with Administrator privileges can upload arbitrary files, potentially including malicious scripts or executables, thereby enabling remote code execution on the affected server.", "risk_and_exploitability": "The flaw carries a CVSS score of 7.2, indicating high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog. The attack vector is inferred to be a local authenticated user with Administrator privileges; the absence of file type checks allows the attacker to deposit executable content that can be later triggered to run server\u2011side."}}}}, "created": "2025-10-20T13:26:55.846603+00:00", "updated": "2026-04-22T14:15:20.401019+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}