PT-2025-47698 · WordPress · Import Wp – Export/Import Csv/Xml Files To Wordpress

Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-12894

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Import WP – Export and Import CSV and XML files to WordPress plugin versions prior to 2.14.18

Description The Import WP plugin for WordPress is susceptible to sensitive information exposure. This issue stems from a lack of .htaccess protection and vulnerabilities within the import/export functionality. Unauthenticated attackers may be able to extract sensitive data from exports stored in the /exportwp directory and import data stored in the /importwp directory.

Recommendations Update to version 2.14.18 or later.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-12894

Affected Products

Import Wp – Export/Import Csv/Xml Files To Wordpress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12894 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/28ca9590-dc0b-40c9-9de6-1480094ea8be?source=cve · Note
• https://t.me/CVEtracker/37910 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991803880435335272 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394624%40jc-importer&new=3394624%40jc-importer&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1991776216706347368 · Twitter Post