CVE-2025-14478

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14478", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T18:36:47.883Z", "datePublished": "2026-01-17T07:27:37.627Z", "dateUpdated": "2026-04-08T17:16:27.643Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:27.643Z"}, "affected": [{"vendor": "kraftplugins", "product": "Demo Importer Plus", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0."}], "title": "Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b2971aa0-8287-4142-bd04-7aec1ed92e7b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php#L88"}, {"url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/tags/2.0.6/inc/importers/class-demo-importer-plus-sites-helper.php#L88"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439643/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "cweId": "CWE-611", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lorenzo Franchini"}], "timeline": [{"time": "2025-12-10T18:54:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-16T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T19:10:05.470176Z", "id": "CVE-2025-14478", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:23:29.088Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14478", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T19:10:05.470176Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:10:11.880Z"}}], "cna": {"title": "Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Lorenzo Franchini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "kraftplugins", "product": "Demo Importer Plus", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-10T18:54:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-16T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b2971aa0-8287-4142-bd04-7aec1ed92e7b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php#L88"}, {"url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/tags/2.0.6/inc/importers/class-demo-importer-plus-sites-helper.php#L88"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439643/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php"}], "descriptions": [{"lang": "en", "value": "The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-17T07:27:37.627Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14478", "state": "PUBLISHED", "dateUpdated": "2026-01-20T19:23:29.088Z", "dateReserved": "2025-12-10T18:36:47.883Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-17T07:27:37.627Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Demo Importer Plus", "vendor": "kraftplugins", "versions": [{"lessThanOrEqual": "2.0.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0."}, {"lang": "es", "value": "El plugin Demo Importer Plus para WordPress es vulnerable a la Inyecci\u00f3n de Entidad Externa XML (XXE) en todas las versiones hasta la 2.0.9, inclusive, a trav\u00e9s de la funcionalidad de carga de archivos SVG. Esto permite a atacantes autenticados, con acceso de nivel de Autor y superior, lograr la ejecuci\u00f3n de c\u00f3digo en configuraciones vulnerables. Esto solo afecta a sitios en versiones de PHP anteriores a la 8.0."}], "id": "CVE-2025-14478", "lastModified": "2026-06-17T08:35:59.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14478", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T19:10:05.470176Z", "version": "2.0.3"}}]}, "published": "2026-01-17T08:15:51.040", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/tags/2.0.6/inc/importers/class-demo-importer-plus-sites-helper.php#L88"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php#L88"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3439643/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b2971aa0-8287-4142-bd04-7aec1ed92e7b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:21:36.775497+00:00", "value": {"mitigation_remediation": ["Update the Demo Importer Plus plugin to a version newer than 2.0.9 or uninstall the plugin from the WordPress site.", "If an update is unavailable, disable the SVG upload feature and restrict upload permissions so that only users below Author level can upload files.", "Upgrade the PHP runtime to version 8.0 or newer \u2013 the vulnerability does not affect PHP 8.0+.", "Enable logging of file upload events and monitor for unexpected SVG uploads or signs of code execution."], "summary": {"action": "Patch Immediately", "impact": "Authenticated Code Execution"}, "threat_synthesis": {"affected_systems": "Sites that use the kraftplugins:Demo Importer Plus WordPress plugin with versions 2.0.9 or earlier are affected. The vulnerability is limited to installations that employ PHP versions below 8.0, and the attack requires the user to possess at least Author rights or higher on the WordPress site.", "description_and_impact": "The Demo Importer Plus plugin for WordPress contains an XML External Entity injection flaw that can be triggered through its SVG file upload feature. When an authenticated user with Author-level access or higher uploads a specially crafted SVG file, the plugin\u2019s XML parser may process external entities and cause code execution on the server. This weakness is identified as CWE-611 and allows attackers to run arbitrary code, potentially compromising the entire WordPress installation in environments using PHP versions older than 8.0.", "risk_and_exploitability": "The CVSS score for this issue is 7.5, indicating a high severity. The EPSS score is less than 1%, suggesting a low but non\u2011zero likelihood of exploitation in the wild. The vulnerability is not presently listed in the CISA KEV catalog. The attack vector requires an authenticated user to upload a malicious SVG file, which disproportionately targets sites that allow authors to publish media and do not restrict file types. In the absence of any official patch, attackers could abuse this flaw by crafting a payload that exploits PHP\u2019s XML parser to execute arbitrary code. Administrative or technical details to exploit are not disclosed in the public description, but the compromise path is clear: authenticated upload \u2192 XML entity processing \u2192 code execution. The high severity, coupled with the fact that the flaw exists in a commonly used plugin, warrants immediate attention."}}}}, "created": "2026-01-19T09:19:21.750258+00:00", "updated": "2026-04-21T00:30:22.968538+00:00", "vendors": ["kraftplugins", "kraftplugins$PRODUCT$demo_importer_plus", "wordpress", "wordpress$PRODUCT$wordpress"]}