PT-2025-37005 · WordPress · Import Any Xml

Nguyen Quang Truong + 2 · Published 2025-09-10 · Updated 2025-09-15 · CVE-2025-10001

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Import any XML, CSV or Excel File to WordPress plugin versions through 3.9.3

Description: The Import any XML, CSV or Excel File to WordPress plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation during the import process. This allows authenticated attackers with Administrator-level access or higher to upload potentially harmful files, such as .phar files, to the server. Successful exploitation may lead to remote code execution.

Recommendations: Update to a version beyond 3.9.3.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-10001

Affected Products

Import Any Xml

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10001 · Security Note
• https://plugins.trac.wordpress.org/changeset/3358208/wp-all-import/trunk/classes/upload.php · Note
• https://twitter.com/CVEnew/status/1965691850632954239 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965735369053282719 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bb03aeb8-32ab-4962-bc95-b10fb7bd7fcf?source=cve · Note
• https://twitter.com/cracbot/status/1967543957954678997 · Twitter Post