PT-2025-14025 · WordPress · Import Export Suite For Csv/Xml Datafeed

Michael Mazzolini · Published 2025-04-01 · Updated 2025-04-02 · CVE-2025-2007

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Import Export Suite for CSV and XML Datafeed plugin for WordPress versions up to, and including, 7.19

Description The issue is related to insufficient file path validation in the deleteImage() function, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as wp-config.php, are deleted.

Recommendations For versions up to, and including, 7.19, consider disabling the deleteImage() function until a patch is available to prevent arbitrary file deletion. Restrict access to sensitive files on the server to minimize the risk of exploitation.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-2007

Affected Products

Import Export Suite For Csv/Xml Datafeed

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-2007 · Security Note
• https://twitter.com/vulns_space/status/1906943526744547658 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3266286 · Note
• https://plugins.trac.wordpress.org/changeset/3261521/wp-ultimate-csv-importer/trunk/MediaHandling.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3923c732-80b5-4a04-80dd-b4d5b5e5567d?source=cve · Note
• https://reddit.com/r/pwnhub/comments/1jprff4/20000_wordpress_sites_at_risk_from_critical · Reddit Post
• https://twitter.com/CVEnew/status/1906977436278952353 · Twitter Post