CVE-2025-10001: WordPress Import Plugin RCE Vulnerability

CVE-2025-10001 Overview

CVE-2025-10001 affects the Import any XML, CSV or Excel File to WordPress plugin (wp-all-import) in all versions up to and including 3.9.3. The plugin fails to validate file types in its import functionality, allowing authenticated attackers with Administrator-level access to upload arbitrary files including .phar files. Successful exploitation can lead to remote code execution on the affected WordPress server. The flaw is categorized under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated administrators can upload executable PHP archives, enabling arbitrary code execution and full compromise of the underlying web server.

Affected Products

Import any XML, CSV or Excel File to WordPress plugin (wp-all-import)
All plugin versions up to and including 3.9.3
WordPress sites running the vulnerable plugin with Administrator accounts

Discovery Timeline

2025-09-10 - CVE-2025-10001 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10001

Vulnerability Analysis

The vulnerability exists in the import handling routine within classes/upload.php of the wp-all-import plugin. The import workflow accepts user-supplied files but does not enforce a restrictive allowlist of permitted extensions or MIME types. An authenticated attacker with Administrator privileges can submit files with executable extensions such as .phar, which PHP-enabled web servers interpret as code. The exploitation chain is straightforward for an attacker who already controls an administrator account, including scenarios involving stolen credentials, session hijacking, or compromised privileged users. Once a .phar payload lands in a web-accessible directory, requesting the file triggers PHP execution under the web server context.

Root Cause

The root cause is missing file type validation in the plugin's import functionality. The upload handler in classes/upload.php did not block dangerous extensions before persisting files to disk. The vendor remediated the issue in WordPress Changeset 3358208, which tightens validation in the upload path.

Attack Vector

The attack vector is network-based but requires high privileges. An attacker authenticated as an Administrator navigates to the plugin's import interface and submits a malicious file with an executable extension. After upload, the attacker requests the file via HTTP to trigger PHP execution. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-10001

Indicators of Compromise

Presence of files with .phar, .phtml, or other PHP-executable extensions in WordPress upload directories such as wp-content/uploads/wpallimport/
HTTP POST requests to wp-admin/admin.php referencing the wp-all-import action with non-standard file extensions
Outbound network connections originating from the web server process shortly after import activity

Detection Strategies

Audit the wp-all-import upload directories for files with extensions other than .xml, .csv, .xls, or .xlsx
Review WordPress activity logs for import operations performed by administrator accounts outside expected change windows
Inspect web server access logs for requests directly targeting files inside import staging directories

Monitoring Recommendations

Alert on new PHP-executable files written under wp-content/uploads/ across monitored WordPress hosts
Monitor administrator login events for unusual source IPs, geolocations, or session durations
Correlate file write events with subsequent HTTP GET requests to the same path to detect upload-then-execute patterns

How to Mitigate CVE-2025-10001

Immediate Actions Required

Update the Import any XML, CSV or Excel File to WordPress plugin to a version newer than 3.9.3 that includes the fix from changeset 3358208
Audit all administrator accounts and rotate credentials for any that show signs of compromise
Enforce multi-factor authentication for all WordPress administrator accounts to reduce risk of credential abuse

Patch Information

The vendor addressed the missing file type validation in WordPress Changeset 3358208, which updates classes/upload.php to reject unsafe extensions during the import workflow. Administrators should upgrade through the WordPress plugin updater and verify the installed version reflects the patched release.

Workarounds

Temporarily deactivate the wp-all-import plugin until the patched version is installed
Configure the web server to deny execution of PHP files within the wp-content/uploads/ directory tree
Restrict administrator role assignment to a minimal set of trusted users while the patch is applied

bash

# Apache: block PHP execution inside the uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(phar|php|phtml|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx equivalent in the server block
location ~* /wp-content/uploads/.*\.(phar|php|phtml|php[0-9])$ {
    deny all;
    return 403;
}