CVE-2025-13145

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13145", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-13T19:07:19.403Z", "datePublished": "2025-11-19T05:45:13.217Z", "dateUpdated": "2026-04-08T16:56:09.377Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:09.377Z"}, "affected": [{"vendor": "smackcoders", "product": "WP Ultimate CSV Importer \u2013 Import CSV, XML & Excel into WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.33.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."}], "title": "WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e441699-4c78-4277-8ac1-f33b810e78cb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/SingleImportExport.php#L116"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397842/wp-ultimate-csv-importer/trunk/SingleImportExport.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dieu Link"}, {"lang": "en", "type": "finder", "value": "GCSC Vietnam"}], "timeline": [{"time": "2025-11-13T19:22:27.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-18T17:44:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T20:27:05.837164Z", "id": "CVE-2025-13145", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T20:27:18.817Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13145", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-13T19:07:19.403Z", "datePublished": "2025-11-19T05:45:13.217Z", "dateUpdated": "2025-11-19T20:27:18.817Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-19T05:45:13.217Z"}, "affected": [{"vendor": "smackcoders", "product": "WP Import \u2013 Ultimate CSV XML Importer for WordPress", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "7.33.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."}], "title": "WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e441699-4c78-4277-8ac1-f33b810e78cb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/SingleImportExport.php#L116"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397842/wp-ultimate-csv-importer/trunk/SingleImportExport.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dieu Link"}, {"lang": "en", "type": "finder", "value": "GCSC Vietnam"}], "timeline": [{"time": "2025-11-13T19:22:27.000+00:00", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-18T17:44:17.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13145", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T20:27:05.837164Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T20:27:12.886Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Ultimate CSV Importer \u2013 Import CSV, XML & Excel into WordPress", "vendor": "smackcoders", "versions": [{"lessThanOrEqual": "7.33.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."}, {"lang": "es", "value": "El plugin de WordPress WP Import - Ultimate CSV XML Importer for WordPress es vulnerable a la inyecci\u00f3n de objetos PHP en todas las versiones hasta la 7.33.1, inclusive. Esto se debe a la deserializaci\u00f3n de datos no confiables suministrados a trav\u00e9s de importaciones de archivos CSV en la funci\u00f3n 'import_single_post_as_csv' dentro de 'SingleImportExport.php'. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador o superior, inyecten un objeto PHP. Si una cadena POP est\u00e1 presente a trav\u00e9s de un plugin o tema adicional instalado en el sistema objetivo, podr\u00eda permitir al atacante eliminar archivos arbitrarios, recuperar datos sensibles o ejecutar c\u00f3digo."}], "id": "CVE-2025-13145", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13145", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T20:27:05.837164Z", "version": "2.0.3"}}]}, "published": "2025-11-19T06:15:47.563", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/SingleImportExport.php#L116"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3397842/wp-ultimate-csv-importer/trunk/SingleImportExport.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e441699-4c78-4277-8ac1-f33b810e78cb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:10:38.943758+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Ultimate CSV Importer to the latest release that removes the vulnerable deserialization code.", "Reduce the scope of administrator privileges for users who do not need CSV import functionality to mitigate the attacker\u2019s prerequisite for exploit.", "Ensure all other plugins and themes are up\u2011to\u2011date and do not expose PHP object injection chains that could be chained with this vulnerability."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites running the WP Ultimate CSV Importer plugin (developed by smackcoders) version 7.33.1 or older are affected. Any installation of this plugin with administrator\u2011level or higher privileges is at risk.", "description_and_impact": "The WP Ultimate CSV Importer plugin is vulnerable to PHP Object Injection via the import_single_post_as_csv function. An attacker with administrator\u2011level access can supply a crafted CSV file that is deserialized, allowing the injection of a PHP object. This flaw, classified as CWE\u2011502, can lead to the deletion of arbitrary files, retrieval of sensitive data, or execution of arbitrary code if a PHP object property chain is present.", "risk_and_exploitability": "The CVSS score is 7.2, indicating a high severity. The EPSS score is below 1%, suggesting low to moderate likelihood of exploitation but still significant. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires an authenticated user with administrator role to upload a malicious CSV file; if a PHP object property chain exists in another plugin or theme, the attacker can perform file deletions, data exfiltration, or arbitrary code execution."}}}}, "created": "2025-11-24T09:10:50.196576+00:00", "updated": "2026-04-21T18:15:36.375942+00:00", "vendors": ["smackcoders", "smackcoders$PRODUCT$ultimate_csv_importer", "smackcoders$PRODUCT$wp_ultimate_csv_importer", "wordpress", "wordpress$PRODUCT$wordpress"]}