CVE-2025-12137

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12137", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-23T21:15:40.493Z", "datePublished": "2025-11-01T06:40:40.047Z", "dateUpdated": "2026-04-08T17:32:21.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:21.492Z"}, "affected": [{"vendor": "jcollings", "product": "Import WP \u2013 Export and Import CSV and XML files to WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.14.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Import WP \u2013 Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths without proper validation in the 'attach_file()' function when handling 'file_local' actions. This makes it possible for authenticated attackers, with administrator-level access and above, to read arbitrary files on the server's filesystem, including sensitive configuration files and system files via the 'local_url' parameter."}], "title": "Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f10636ea-06aa-4186-a891-ed4bb0800c41?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Rest/RestManager.php#L1079"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Importer/ImporterManager.php#L435"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L212"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L56"}, {"url": "https://owasp.org/www-community/attacks/Path_Traversal"}, {"url": "https://cwe.mitre.org/data/definitions/36.html"}, {"url": "https://github.com/importwp/importwp/commit/94cc524aa0c81be6463a9e8d154b00220e34709c"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387749%40jc-importer&new=3387749%40jc-importer&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-73 External Control of File Name or Path", "cweId": "CWE-73", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-24T17:58:36.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-31T17:58:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T13:10:35.006687Z", "id": "CVE-2025-12137", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:30:23.253Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12137", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T13:10:35.006687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:10:35.764Z"}}], "cna": {"title": "Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "jcollings", "product": "Import WP \u2013 Export and Import CSV and XML files to WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.14.16"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-24T17:58:36.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-31T17:58:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f10636ea-06aa-4186-a891-ed4bb0800c41?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Rest/RestManager.php#L1079"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Importer/ImporterManager.php#L435"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L212"}, {"url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L56"}, {"url": "https://owasp.org/www-community/attacks/Path_Traversal"}, {"url": "https://cwe.mitre.org/data/definitions/36.html"}, {"url": "https://github.com/importwp/importwp/commit/94cc524aa0c81be6463a9e8d154b00220e34709c"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387749%40jc-importer&new=3387749%40jc-importer&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Import WP \u2013 Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths without proper validation in the 'attach_file()' function when handling 'file_local' actions. This makes it possible for authenticated attackers, with administrator-level access and above, to read arbitrary files on the server's filesystem, including sensitive configuration files and system files via the 'local_url' parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73 External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-01T06:40:40.047Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12137", "state": "PUBLISHED", "dateUpdated": "2025-11-03T13:30:23.253Z", "dateReserved": "2025-10-23T21:15:40.493Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T06:40:40.047Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Import WP \u2013 Export and Import CSV and XML files to WordPress", "vendor": "jcollings", "versions": [{"lessThanOrEqual": "2.14.16", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Import WP \u2013 Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths without proper validation in the 'attach_file()' function when handling 'file_local' actions. This makes it possible for authenticated attackers, with administrator-level access and above, to read arbitrary files on the server's filesystem, including sensitive configuration files and system files via the 'local_url' parameter."}, {"lang": "es", "value": "El plugin de WordPress \u201cImport WP - Export and Import CSV and XML files to WordPress\u201d es vulnerable a la lectura arbitraria de archivos en todas las versiones hasta la 2.14.16, inclusive. Esto se debe a que el endpoint de la API REST del plugin acepta rutas de archivo absolutas arbitrarias sin la validaci\u00f3n adecuada en la funci\u00f3n 'attach_file()' al manejar acciones 'file_local'. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador y superior, lean archivos arbitrarios en el sistema de archivos del servidor, incluyendo archivos de configuraci\u00f3n sensibles y archivos del sistema a trav\u00e9s del par\u00e1metro 'local_url'."}], "id": "CVE-2025-12137", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12137", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T13:10:35.006687Z", "version": "2.0.3"}}]}, "published": "2025-11-01T07:15:35.333", "references": [{"source": "security@wordfence.com", "url": "https://cwe.mitre.org/data/definitions/36.html"}, {"source": "security@wordfence.com", "url": "https://github.com/importwp/importwp/commit/94cc524aa0c81be6463a9e8d154b00220e34709c"}, {"source": "security@wordfence.com", "url": "https://owasp.org/www-community/attacks/Path_Traversal"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L212"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L56"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Importer/ImporterManager.php#L435"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Rest/RestManager.php#L1079"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387749%40jc-importer&new=3387749%40jc-importer&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f10636ea-06aa-4186-a891-ed4bb0800c41?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:42:38.947388+00:00", "value": {"mitigation_remediation": ["Update the Import WP plugin to version 2.14.17 or later, which removes the vulnerability by validating file paths.", "If an update is not immediately possible, restrict or disable the REST API endpoint that handles the 'file_local' action for administrator accounts.", "Ensure that critical system files and configuration directories have strict file permissions and are not readable by the web server process or WordPress user."], "summary": {"action": "Patch Plugin", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "The issue affects all installations of the Import WP \u2013 Export and Import CSV and XML files to WordPress plugin with versions 2.14.16 or earlier when running on WordPress sites. Any site using the vulnerable plugin and where an attacker can gain administrator privileges is at risk. The plugin is maintained by developer jcollings.", "description_and_impact": "The vulnerability in the Import WP plugin allows an authenticated administrator to request arbitrary files on the server via the REST API endpoint. The plugin accepts absolute file paths without validation, meaning the local_url parameter can be set to any file system location. The attacker can read sensitive configuration files, credentials, or system files, compromising confidentiality.", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity, with the EPSS score less than 1% suggesting that exploit attempts are currently rare. The vulnerability is listed as not in the CISA KEV catalog. An attacker must be authenticated with administrator or higher rights to trigger the REST API, limiting the attack surface to privileged accounts. However, once the condition is met, the attacker can read arbitrary files, which could lead to credential theft or other sensitive data exposure."}}}}, "created": "2025-11-03T10:43:37.418820+00:00", "updated": "2026-04-21T18:45:06.084127+00:00", "vendors": ["jcollings", "jcollings$PRODUCT$import_wp", "wordpress", "wordpress$PRODUCT$wordpress"]}