PT-2025-31913 · WordPress · Wp Import Export Lite

Jérôme Gaudin + 2 · Published 2025-08-05 · Updated 2025-08-12 · CVE-2025-6207

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Import Export Lite versions through 3.9.28

Description The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpie tempalte import function. This allows authenticated attackers with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Recommendations Update WP Import Export Lite to a version beyond 3.9.28.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-6207

Affected Products

Wp Import Export Lite

References · 11

• https://plugins.trac.wordpress.org/changeset/3323402 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-6207 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6207 · Vendor Advisory
• https://twitter.com/cracbot/status/1954498017463062644 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/188eef67-de66-49c2-aa6c-2cf3b886ff66?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1952674048569201002 · Twitter Post
• https://t.me/cveNotify/131859 · Telegram Post
• https://t.me/CVEtracker/29191 · Telegram Post
• https://twitter.com/CVEnew/status/1952637809304523226 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/includes/classes/class-wpie-common-action.php#L386 · Note
• https://t.me/cveNotify/130885 · Telegram Post