PT-2026-3354 · WordPress · Demo Importer Plus

Lorenzo Franchini · Publicado 2026-01-17 · Atualizado 2026-01-22 · CVE-2025-14478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Demo Importer Plus plugin for WordPress versions up to and including 2.0.9

Description The software is susceptible to XML External Entity Injection (XXE) through the SVG file upload functionality. This allows authenticated attackers with Author-level access or higher to potentially achieve code execution in vulnerable configurations. This issue only impacts sites using PHP versions older than 8.0.

Recommendations Update the Demo Importer Plus plugin to a version newer than 2.0.9. For sites using PHP versions older than 8.0, consider alternative methods for importing demos that do not involve SVG file uploads.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2025-14478

Produtos afetados

Demo Importer Plus

Referências · 8

• https://plugins.trac.wordpress.org/changeset/3439643/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php · Nota
• https://plugins.trac.wordpress.org/browser/demo-importer-plus/tags/2.0.6/inc/importers/class-demo-importer-plus-sites-helper.php#L88 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b2971aa0-8287-4142-bd04-7aec1ed92e7b?source=cve · Nota
• https://twitter.com/VulmonFeeds/status/2012448206446014937 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14478 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/demo-importer-plus/trunk/inc/importers/class-demo-importer-plus-sites-helper.php#L88 · Nota
• https://twitter.com/CVEnew/status/2012490341685825756 · Publicação no Twitter
• https://twitter.com/cracbot/status/2014291998975619101 · Publicação no Twitter