CVE-2025-10057: WP Import Plugin RCE Vulnerability

CVE-2025-10057 Overview

CVE-2025-10057 is a Remote Code Execution (RCE) vulnerability in the WP Import – Ultimate CSV XML Importer for WordPress plugin. The flaw affects all versions up to and including 7.28. The write_to_customfile() function writes unfiltered PHP code to disk, allowing authenticated attackers with Subscriber-level access or higher to inject arbitrary PHP into the customFunction.php file. Once written, attackers request the file to trigger code execution under the web server context. The issue maps to CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated Subscriber-level users can achieve full Remote Code Execution on affected WordPress sites, leading to complete site compromise.

Affected Products

WP Import – Ultimate CSV XML Importer for WordPress plugin, versions up to and including 7.28
WordPress sites with the plugin enabled and any registered users at Subscriber level or above
WordPress deployments that allow open user registration with the plugin active

Discovery Timeline

2025-09-17 - CVE-2025-10057 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10057

Vulnerability Analysis

The vulnerability resides in the plugin's write_to_customfile() function, located in importExtensions/ImportHelpers.php. The function accepts user-controlled input and writes it directly to customFunction.php without sanitization, validation, or filtering of PHP syntax. Because the destination file is a PHP script within the web root, any content written becomes executable when the file is requested.

Attackers only need an authenticated session at the Subscriber role, the lowest privileged WordPress role available through default registration. This eliminates most barriers to exploitation on sites that permit user signups. The vulnerability requires no user interaction beyond the attacker's own authenticated request.

Successful exploitation grants the attacker code execution under the PHP-FPM or web server user. This enables data exfiltration, persistent backdoor installation, lateral movement to the underlying host, and pivoting to other tenants in shared hosting environments.

Root Cause

The root cause is the absence of input validation and the use of a writable PHP file as a configuration sink. The plugin treats user-supplied content as trusted code and persists it to an executable script. Combined with a low privilege requirement, this design results in a code injection primitive directly exposed to authenticated attackers.

Attack Vector

Exploitation occurs over the network against an authenticated endpoint. The attacker authenticates to WordPress, invokes the plugin functionality that calls write_to_customfile() with a malicious payload containing PHP code, and then issues an HTTP request to the resulting customFunction.php to trigger execution. Refer to the Wordfence Vulnerability Report and the WordPress Import Helpers Code for the underlying implementation details.

Detection Methods for CVE-2025-10057

Indicators of Compromise

Unexpected modifications to wp-content/plugins/wp-ultimate-csv-importer/customFunction.php, particularly content containing PHP tags, eval, system, exec, passthru, or base64-encoded payloads.
HTTP requests directly accessing customFunction.php from external IP addresses with no legitimate referrer.
New Subscriber-level accounts created shortly before plugin endpoint activity, especially from registration forms with weak abuse controls.
Outbound network connections originating from the PHP worker process to attacker-controlled infrastructure following plugin activity.

Detection Strategies

Monitor file integrity on the plugin directory and alert on any write to customFunction.php outside of approved maintenance windows.
Inspect WordPress access logs for POST requests to plugin admin-ajax or REST routes followed by GET requests to customFunction.php.
Hunt for PHP process spawns of shell utilities such as sh, bash, curl, wget, or php -r originating from the web server user.

Monitoring Recommendations

Enable WordPress audit logging for plugin imports, user role changes, and registration events.
Correlate web server logs with endpoint telemetry to identify command execution chains stemming from the web tier.
Track outbound DNS and HTTP egress from web servers to detect post-exploitation command-and-control traffic.

How to Mitigate CVE-2025-10057

Immediate Actions Required

Update the WP Import – Ultimate CSV XML Importer plugin to a version later than 7.28 that includes the fix referenced in WordPress Changeset 3360428.
Audit customFunction.php for unauthorized PHP code and restore it from a known-good baseline if tampering is suspected.
Review and remove suspicious Subscriber and higher-privileged accounts created in the affected window.
Rotate WordPress secrets, database credentials, and API keys accessible from the web tier if compromise is suspected.

Patch Information

The vendor addressed the vulnerability in changeset 3360428, which modifies both importExtensions/ImportHelpers.php and uploadModules/DesktopUpload.php. Review the WordPress Changeset 3360428 for ImportHelpers and the WordPress Upload Module Changeset for the corrective code changes. Upgrade to the fixed plugin release through the WordPress admin dashboard or via WP-CLI.

Workarounds

Disable and remove the WP Import – Ultimate CSV XML Importer plugin until the patched version is installed.
Disable open user registration in WordPress settings to reduce the attacker pool capable of obtaining Subscriber access.
Restrict web server write permissions to plugin directories where feasible, and block direct HTTP access to customFunction.php via web server rules.
Deploy a web application firewall rule to block requests targeting the vulnerable plugin endpoints and direct calls to customFunction.php.

bash

# Example nginx rule to block direct access to the vulnerable file
location ~* /wp-content/plugins/wp-ultimate-csv-importer/customFunction\.php$ {
    deny all;
    return 403;
}

# Update the plugin using WP-CLI
wp plugin update wp-ultimate-csv-importer