CVE-2025-12894

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12894", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-07T18:29:34.958Z", "datePublished": "2025-11-21T07:31:49.157Z", "dateUpdated": "2026-04-08T16:43:11.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:11.970Z"}, "affected": [{"vendor": "jcollings", "product": "Import WP \u2013 Export and Import CSV and XML files to WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.14.17", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Import WP \u2013 Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp."}], "title": "Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca9590-dc0b-40c9-9de6-1480094ea8be?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394624%40jc-importer&new=3394624%40jc-importer&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-552 Files or Directories Accessible to External Parties", "cweId": "CWE-552", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2025-11-07T18:44:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-20T18:54:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-21T14:44:09.503149Z", "id": "CVE-2025-12894", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T14:57:01.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12894", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-21T14:44:09.503149Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T14:44:15.289Z"}}], "cna": {"title": "Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "jcollings", "product": "Import WP \u2013 Export and Import CSV and XML files to WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.14.17"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-07T18:44:42.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-20T18:54:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca9590-dc0b-40c9-9de6-1480094ea8be?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394624%40jc-importer&new=3394624%40jc-importer&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Import WP \u2013 Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-21T07:31:49.157Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12894", "state": "PUBLISHED", "dateUpdated": "2025-11-21T14:57:01.592Z", "dateReserved": "2025-11-07T18:29:34.958Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-21T07:31:49.157Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Import WP \u2013 Export and Import CSV and XML files to WordPress", "vendor": "jcollings", "versions": [{"lessThanOrEqual": "2.14.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Import WP \u2013 Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp."}, {"lang": "es", "value": "El plugin Import WP - Export and Import CSV and XML files to WordPress para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 2.14.17, inclusive, a trav\u00e9s de la funcionalidad de importaci\u00f3n/exportaci\u00f3n y una falta de protecci\u00f3n .htaccess. Esto hace posible que atacantes no autenticados extraigan datos sensibles de las exportaciones almacenadas en /exportwp y los datos de importaci\u00f3n almacenados en /importwp."}], "id": "CVE-2025-12894", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12894", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-21T14:44:09.503149Z", "version": "2.0.3"}}]}, "published": "2025-11-21T08:15:54.403", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394624%40jc-importer&new=3394624%40jc-importer&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca9590-dc0b-40c9-9de6-1480094ea8be?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:05:08.366287+00:00", "value": {"mitigation_remediation": ["Update to a release newer than 2.14.17 of the Import WP plugin, if available from the vendor.", "Add or enforce .htaccess rules to protect the /exportwp and /importwp directories, or relocate them outside the web root.", "If the plugin is not required, remove or disable it to eliminate the exposure risk."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "The affected product is the Import WP \u2013 Export and Import CSV and XML files to WordPress plugin, developed by jcollings. All releases of the plugin through version 2.14.17 are impacted. Users of newer releases are presumed unaffected unless the vendor acknowledges otherwise.", "description_and_impact": "The Import WP \u2013 Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 2.14.17. The flaw is caused by the import/export functionality and a lack of .htaccess protection, enabling unauthenticated attackers to read sensitive data from exports stored in /exportwp and import data in /importwp. This weakness corresponds to CWE-552, which denotes sensitive data exposure.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate threat, while the EPSS score of less than 1% suggests low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can likely trigger the exposure by calling the import or export endpoints or accessing the publicly exposed directories, as the plugin does not enforce authentication or directory protection. Without .htaccess protection, any visitor can read files under /exportwp and /importwp, leading to the disclosure of potentially confidential WordPress content."}}}}, "created": "2025-11-24T09:09:34.558976+00:00", "updated": "2026-04-22T21:15:27.676894+00:00", "vendors": ["jcollings", "jcollings$PRODUCT$import_wp", "wordpress", "wordpress$PRODUCT$wordpress"]}