PT-2025-44717 · WordPress · Import Wp – Export/Import Csv/Xml Files To Wordpress

Published 2025-11-01 · Updated 2025-11-01 · CVE-2025-12137

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Import WP – Export and Import CSV and XML files to WordPress plugin versions prior to 2.14.17

Description The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is susceptible to Arbitrary File Read due to insufficient validation of file paths. The plugin’s REST API endpoint accepts arbitrary absolute file paths without proper validation within the attach file() function when processing 'file local' actions. This allows attackers with administrator-level access or higher to read arbitrary files on the server’s filesystem, including sensitive configuration and system files, by manipulating the local url parameter.

Recommendations Update the Import WP – Export and Import CSV and XML files to WordPress plugin to version 2.14.17 or later.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-12137

Affected Products

Import Wp – Export/Import Csv/Xml Files To Wordpress

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-12137 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12137 · Vendor Advisory
• https://github.com/importwp/importwp/commit/94cc524aa0c81be6463a9e8d154b00220e34709c · Note
• https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L56 · Note
• https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Importer/ImporterManager.php#L435 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f10636ea-06aa-4186-a891-ed4bb0800c41?source=cve · Note
• https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Rest/RestManager.php#L1079 · Note
• https://t.me/CVEtracker/36373 · Telegram Post
• https://t.me/cveNotify/141246 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387749%40jc-importer&new=3387749%40jc-importer&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/jc-importer/trunk/class/Common/Filesystem/Filesystem.php#L212 · Note
• https://twitter.com/CVEnew/status/1984514498913325155 · Twitter Post
• https://owasp.org/www-community/attacks/Path_Traversal · Note
• https://cwe.mitre.org/data/definitions/36.html · Note