PT-2025-46245 · WordPress · Wp移行専用プラグイン For Cpi

Kenneth Dunn · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-11170

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP移行専用プラグイン for CPI versions up to and including 1.0.2

Description The WP移行専用プラグイン for CPI plugin for WordPress has a flaw that allows arbitrary file uploads because of a lack of file type validation. This occurs in the Cpiwm Import Controller::import function. Unauthenticated attackers can upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Update WP移行専用プラグイン for CPI to a version later than 1.0.2.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-11170

Affected Products

Wp移行専用プラグイン For Cpi

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-11170 · Security Note
• https://wordpress.org/plugins/cpi-wp-migration · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8a96d6d5-a5e3-4648-902b-f9d1f8e57e5c?source=cve · Note
• https://t.me/cveNotify/142363 · Telegram Post