PT-2025-46780 · WordPress · Wordpress+1

Tmrswrr · Published 2025-11-13 · Updated 2025-11-18 · CVE-2025-12733

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP All Import versions up to and including 3.9.6

Description The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is susceptible to Remote Code Execution. This is caused by the use of eval() on unsanitized user-supplied input within the pmxi if function located in helpers/functions.php. Authenticated attackers with import capabilities can inject and execute arbitrary PHP code on the server through crafted import templates. This could lead to remote code execution.

Recommendations Update WP All Import to a version newer than 3.9.6.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-12733

Affected Products

Wp All Import

Wordpress

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-12733 · Security Note
• https://twitter.com/RedPacketSec/status/1988841994941006204 · Twitter Post
• https://twitter.com/CveFindCom/status/1988844517110251674 · Twitter Post
• https://t.me/cveNotify/142625 · Telegram Post
• https://twitter.com/cracbot/status/1990736799531217055 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8475dd90-b47a-42b4-8e4e-44e8512e4fca?source=cve · Note
• https://t.me/CVEtracker/37207 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-all-import/tags/3.9.6/helpers/functions.php#L79 · Note
• https://twitter.com/VulmonFeeds/status/1988882340265730050 · Twitter Post
• https://twitter.com/CVEnew/status/1988820395269767571 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3393968%40wp-all-import&new=3393968%40wp-all-import&sfp_email=&sfph_mail= · Note