PT-2025-50816 · WordPress · Blaze Demo Importer

Kenneth Dunn · Published 2025-12-12 · Updated 2025-12-17 · CVE-2025-13334

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blaze Demo Importer plugin for WordPress versions through 1.0.13

Description The Blaze Demo Importer plugin for WordPress is susceptible to unauthorized database resets and file deletion. This is due to a missing capability check within the blaze demo importer install demo() function. Authenticated attackers with subscriber-level access or higher can truncate all database tables (excluding options, usermeta, and users), delete sidebar widgets, theme modifications, and content within the uploads folder.

Recommendations Update the Blaze Demo Importer plugin to a version beyond 1.0.13.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13334

Affected Products

Blaze Demo Importer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-13334 · Security Note
• https://plugins.trac.wordpress.org/browser/blaze-demo-importer/tags/1.0.13/blaze-demo-importer.php?marks=67-89#L68 · Note
• https://twitter.com/cracbot/status/2001246041874817338 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d83cd6a0-d69c-4e6c-b76f-00c398b5f7e6?source=cve · Note