PT-2025-51045 · WordPress · Design Import/Export

Camilla Flocco · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-14050

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Design Import/Export plugin for WordPress versions up to and including 2.2

Description The Design Import/Export plugin for WordPress is susceptible to SQL Injection through XML File Import. This is due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. An authenticated attacker with administrator privileges can inject additional SQL queries into existing ones, potentially extracting sensitive information from the database.

Recommendations Update the Design Import/Export plugin to a version newer than 2.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-14050

Affected Products

Design Import/Export

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14050 · Security Note
• https://plugins.trac.wordpress.org/changeset/3416324 · Note
• https://plugins.trac.wordpress.org/browser/design-import-export/tags/2.2/includes/importer.php#L162 · Note
• https://t.me/CVEtracker/39685 · Telegram Post
• https://twitter.com/CVEnew/status/1999865379934609708 · Twitter Post
• https://plugins.trac.wordpress.org/browser/design-import-export/trunk/includes/importer.php#L162 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/beb489d3-2c1b-4af5-b73e-126d2526e0a3?source=cve · Note