CVE-2025-12733

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12733", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-04T22:13:08.724Z", "datePublished": "2025-11-13T03:27:38.629Z", "dateUpdated": "2026-04-08T17:04:24.229Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:24.229Z"}, "affected": [{"vendor": "wpallimport", "product": "WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution."}], "title": "Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8475dd90-b47a-42b4-8e4e-44e8512e4fca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-all-import/tags/3.9.6/helpers/functions.php#L79"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3393968%40wp-all-import&new=3393968%40wp-all-import&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "tmrswrr"}], "timeline": [{"time": "2025-11-04T22:28:18.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T14:27:29.135155Z", "id": "CVE-2025-12733", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T14:34:18.306Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12733", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T14:27:29.135155Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T14:27:31.195Z"}}], "cna": {"title": "Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic", "credits": [{"lang": "en", "type": "finder", "value": "tmrswrr"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wpallimport", "product": "WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.9.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-04T22:28:18.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-12T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8475dd90-b47a-42b4-8e4e-44e8512e4fca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-all-import/tags/3.9.6/helpers/functions.php#L79"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3393968%40wp-all-import&new=3393968%40wp-all-import&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:24.229Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12733", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:04:24.229Z", "dateReserved": "2025-11-04T22:13:08.724Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-13T03:27:38.629Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets", "vendor": "wpallimport", "versions": [{"lessThanOrEqual": "3.9.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution."}, {"lang": "es", "value": "El plugin Import any XML, CSV or Excel File to WordPress (WP All Import) para WordPress es vulnerable a ejecuci\u00f3n remota de c\u00f3digo en todas las versiones hasta la 3.9.6, inclusive. Esto se debe al uso de 'eval()' en entradas proporcionadas por el usuario no saneadas en la funci\u00f3n 'pmxi_if' dentro de 'helpers/functions.php'. Esto hace posible que atacantes autenticados, con capacidades de importaci\u00f3n (t\u00edpicamente administradores), inyecten y ejecuten c\u00f3digo PHP arbitrario en el servidor a trav\u00e9s de plantillas de importaci\u00f3n manipuladas. Esto puede conducir a ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-12733", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12733", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-13T14:27:29.135155Z", "version": "2.0.3"}}]}, "published": "2025-11-13T04:15:46.340", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-all-import/tags/3.9.6/helpers/functions.php#L79"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3393968%40wp-all-import&new=3393968%40wp-all-import&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8475dd90-b47a-42b4-8e4e-44e8512e4fca?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:23:12.558069+00:00", "value": {"mitigation_remediation": ["Upgrade WP All Import to the latest available version (3.9.7 or newer), which removes the unsanitized eval usage.", "If an immediate upgrade is not possible, temporarily disable the plugin or revoke import capabilities from administrator accounts to prevent the exploit path.", "Apply the principle of least privilege: limit admin accounts and enforce strong password policies to reduce the likelihood that an attacker can gain the necessary authenticated access."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw affects the WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin, in all released versions up to and including 3.9.6. No later releases are listed as vulnerable, so sites running 3.9.7 or newer are presumed safe.", "description_and_impact": "The vulnerability arises from the use of eval() on unsanitized user input within the pmxi_if function of the WP All Import plugin. This allows an authenticated attacker who has import privileges, such as an administrator, to craft import templates that contain arbitrary PHP code. When the import process evaluates the template, the injected code is executed on the server, granting the attacker full control over the affected WordPress installation.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is not yet widespread but still possible. Because the issue requires authenticated administrator access, the risk is limited to sites with weak account controls or excessive admin privileges. The remote code execution payload can be delivered via a crafted import file, and the plugin\u2019s lack of input validation makes the exploit straightforward for an insider or a compromised admin account. Sites are not listed in the CISA KEV catalog, but the functionality provides a direct code execution path that should be mitigated promptly."}}}}, "created": "2025-11-13T15:50:12.050512+00:00", "updated": "2026-04-21T18:30:27.583928+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpallimport", "wpallimport$PRODUCT$import_any_xml"]}