PT-2025-46245 · WordPress · Wp移行専用プラグイン For Cpi

Kenneth Dunn · CVE-2025-11170 · Publicado 2025-11-11 · Atualizado 2025-11-11

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP移行専用プラグイン for CPI versions up to and including 1.0.2

Description The WP移行専用プラグイン for CPI plugin for WordPress has a flaw that allows arbitrary file uploads because of a lack of file type validation. This occurs in the Cpiwm Import Controller::import function. Unauthenticated attackers can upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Update WP移行専用プラグイン for CPI to a version later than 1.0.2.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2025-11170

Produtos afetados

Wp移行専用プラグイン For Cpi

Referências · 4

• https://wordpress.org/plugins/cpi-wp-migration · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/8a96d6d5-a5e3-4648-902b-f9d1f8e57e5c?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-11170 · Nota de Segurança
• https://t.me/cveNotify/142363 · Publicação no Telegram