CVE-2025-10058: WP Import Path Traversal Vulnerability

CVE-2025-10058 Overview

CVE-2025-10058 is an arbitrary file deletion vulnerability in the WP Import – Ultimate CSV XML Importer for WordPress plugin. The flaw resides in the upload_function() method and stems from insufficient file path validation. All plugin versions up to and including 7.27 are affected. Authenticated attackers holding Subscriber-level access or above can delete arbitrary files on the underlying server. Deleting wp-config.php triggers the WordPress setup workflow, allowing an attacker to reconfigure the site against an attacker-controlled database and achieve remote code execution. The issue is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
Authenticated Subscriber accounts can delete server files, including wp-config.php, leading to full site takeover and remote code execution.

Affected Products

WP Import – Ultimate CSV XML Importer for WordPress plugin, all versions up to and including 7.27
WordPress sites with the plugin installed and user registration enabled (Subscriber role accessible)
The vulnerable code path is located in uploadModules/FtpUpload.php within the upload_function() routine

Discovery Timeline

2025-09-17 - CVE-2025-10058 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10058

Vulnerability Analysis

The vulnerability is a path traversal-driven arbitrary file deletion issue. The upload_function() handler accepts a file path parameter and acts on it without sufficient sanitization or canonicalization. An attacker authenticated as a Subscriber can send a crafted request that references files outside the plugin's intended working directory. The handler then deletes the targeted file from the WordPress server filesystem.

Deleting security-critical files yields significant follow-on impact. Removing wp-config.php puts WordPress back into installation mode, allowing the attacker to point the site at a database they control and execute arbitrary PHP through the resulting administrative session. The technical context for the original code path is published in the WordPress Plugin FTP Upload Code.

Root Cause

The root cause is missing validation of user-supplied file path input passed to a delete operation inside upload_function(). The plugin trusts the attacker-supplied path and does not constrain operations to an allow-listed directory. This is consistent with [CWE-73], where external input controls a filesystem path used in a sensitive operation.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session at the Subscriber level or higher. No user interaction is required beyond the attacker's own request. The attacker invokes the vulnerable plugin endpoint and supplies a path referencing a target file such as wp-config.php. Once the file is deleted, the attacker reaches the WordPress reinstallation screen and pivots to remote code execution. Refer to the Wordfence Vulnerability Analysis for additional behavioral details.

Vulnerability mechanism (prose, no verified PoC published):
1. Attacker authenticates as a Subscriber.
2. Attacker sends a request to the plugin endpoint backed by upload_function().
3. The request specifies a file path outside the plugin's intended scope.
4. upload_function() deletes the referenced file without validating the path.
5. Deletion of wp-config.php triggers WordPress reinstallation, enabling RCE.

Detection Methods for CVE-2025-10058

Indicators of Compromise

Unexpected absence of wp-config.php, .htaccess, or other WordPress core files on a host running the plugin
WordPress unexpectedly displaying the /wp-admin/install.php setup screen to visitors
HTTP requests to plugin endpoints under wp-ultimate-csv-importer originating from Subscriber-level accounts
New or unrecognized administrator accounts created after a reinstallation event

Detection Strategies

Monitor web server access logs for POST requests to wp-ultimate-csv-importer routes that include path traversal patterns such as ..%2F or absolute paths
Compare current WordPress core file inventories against a known-good baseline to surface deletions of wp-config.php or other critical files
Alert on any session that authenticates as a Subscriber and immediately invokes plugin import or upload endpoints

Monitoring Recommendations

Enable file integrity monitoring (FIM) on the WordPress document root and watch for delete events on configuration files
Forward web server, PHP, and WordPress audit logs to a centralized analytics pipeline for correlation
Track Subscriber account registration spikes that precede plugin endpoint activity

How to Mitigate CVE-2025-10058

Immediate Actions Required

Update the WP Import – Ultimate CSV XML Importer plugin to a version newer than 7.27 that includes the fix referenced in the WordPress CSV Importer Changeset
Audit the WordPress user table and remove untrusted Subscriber accounts created during the exposure window
Verify the integrity of wp-config.php and restore from backup if it is missing or modified

Patch Information

The vendor addressed the issue in updates published via the WordPress plugin repository. The relevant code changes are tracked in Changeset 3357936 and Changeset 3360611. Site operators should upgrade to the latest available version of the plugin.

Workarounds

Disable and remove the plugin until it can be updated
Disable open WordPress user registration (Settings → General → Membership) to remove the Subscriber-access prerequisite
Restrict access to /wp-admin/admin-ajax.php and plugin endpoints with a web application firewall rule blocking traversal sequences in upload parameters

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0

# Verify wp-config.php is present and owned correctly
ls -l /var/www/html/wp-config.php

# Deactivate the vulnerable plugin until patched
wp plugin deactivate wp-ultimate-csv-importer