PT-2025-49187 · WordPress · Demo Importer Plus

Michael Mazzolini · Published 2025-12-05 · Updated 2025-12-10 · CVE-2025-13066

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Demo Importer Plus plugin for WordPress versions up to and including 2.0.6

Description The Demo Importer Plus plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when processing WXR files. This allows attackers to bypass sanitization by using double extension files, potentially leading to remote code execution. The issue affects authenticated attackers with author-level access or higher.

Recommendations Versions prior to and including 2.0.6 should have file upload access restricted. Monitor file uploads for suspicious activity.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-13066

Affected Products

Demo Importer Plus

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13066 · Security Note
• https://t.me/CVEtracker/38889 · Telegram Post
• https://twitter.com/CveFindCom/status/1996801480376861091 · Twitter Post
• https://twitter.com/cracbot/status/1998709316166295576 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7df0ea8a-5e2c-4f5e-a326-b92df37ffa3c?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3400301/demo-importer-plus/trunk/inc/importers · Note
• https://twitter.com/CVEnew/status/1996798441918181552 · Twitter Post
• https://twitter.com/offseq/status/1996792366284308510 · Twitter Post