PT-2025-47692 · WordPress · Wordpress Url Image Importer

Kenneth Dunn · Published 2025-11-21 · Updated 2025-11-26 · CVE-2025-12138

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress URL Image Importer plugin versions up to and including 1.0.6

Description The WordPress URL Image Importer plugin is susceptible to arbitrary file uploads because of inadequate file type validation. The plugin depends on a user-controlled Content-Type HTTP header to validate file uploads. The uimptr import image from url() function writes the file to the server before performing proper validation. This allows authenticated attackers with Author-level access or higher to upload arbitrary files to the affected site's server, potentially leading to remote code execution through uploaded PHP files.

Recommendations Update the WordPress URL Image Importer plugin to a version newer than 1.0.6.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12138

Affected Products

Wordpress Url Image Importer

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-12138 · Security Note
• https://twitter.com/cracbot/status/1993635895308951629 · Twitter Post
• https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1319 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395852%40url-image-importer&new=3395852%40url-image-importer&sfp_email=&sfph_mail=#file9 · Note
• https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L198 · Note
• https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1358 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1da18430-1bd0-4f63-9e22-5d26de2be410?source=cve · Note
• https://twitter.com/CVEnew/status/1991776218484732415 · Twitter Post
• https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1353 · Note
• https://twitter.com/VulmonFeeds/status/1991824359984341044 · Twitter Post
• https://twitter.com/gothburz/status/1992020594917888419 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1991790673838645733 · Twitter Post
• https://twitter.com/CveFindCom/status/1991834088693485647 · Twitter Post