PT-2025-47286 · WordPress · Simple User Import Export

Ivan Cese · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-13133

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Simple User Import Export plugin for WordPress versions up to and including 1.1.7

Description The Simple User Import Export plugin for WordPress is susceptible to CSV Injection through the 'Import/export users' function. This allows authenticated attackers with Administrator-level access or higher to inject untrusted input into exported CSV files. Opening these files on a local system with a vulnerable configuration can lead to code execution.

Recommendations Update the Simple User Import Export plugin to version 1.1.8 or later.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2025-13133

Affected Products

Simple User Import Export

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13133 · Security Note
• https://t.me/cveNotify/143177 · Telegram Post
• https://it.wordpress.org/plugins/a3-user-importer · Note
• https://twitter.com/VulmonFeeds/status/1990820727818277158 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/39ec49b4-f0f3-4ec7-b11b-ce808c025577?source=cve · Note
• https://t.me/CVEtracker/37592 · Telegram Post
• https://twitter.com/CVEnew/status/1990717536766222551 · Twitter Post