CVE-2025-11170: WordPress CPI Migration Plugin RCE Flaw

CVE-2025-11170 Overview

CVE-2025-11170 is a critical arbitrary file upload vulnerability affecting the WP移行専用プラグイン for CPI plugin for WordPress. The vulnerability exists due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to and including 1.0.2. This security flaw allows unauthenticated attackers to upload arbitrary files on the affected site's server, potentially enabling remote code execution.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to upload malicious files such as PHP webshells, leading to complete server compromise and remote code execution without any authentication requirements.

Affected Products

• WP移行専用プラグイン for CPI plugin for WordPress versions up to and including 1.0.2
• WordPress installations running the vulnerable CPI WP Migration plugin
• Web servers hosting WordPress sites with the affected plugin enabled

Discovery Timeline

• 2025-11-11 - CVE-2025-11170 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-11170

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The WP移行専用プラグイン for CPI plugin, designed for WordPress site migration purposes, contains a critical flaw in its file import functionality. The Cpiwm_Import_Controller::import function fails to properly validate the type of files being uploaded during the import process.

Because there is no authentication requirement to access this function, any remote attacker can submit malicious files directly to the vulnerable endpoint. The complete lack of file type validation means attackers can upload executable PHP files, webshells, or other dangerous file types that the web server will execute.

Root Cause

The root cause of this vulnerability lies in the absence of file type validation within the Cpiwm_Import_Controller::import function. The plugin developers did not implement proper checks to verify that uploaded files match expected safe file types (such as legitimate migration data files). Additionally, the import functionality is exposed without requiring authentication, creating a direct attack surface for unauthenticated remote attackers.

Attack Vector

The vulnerability is exploitable over the network without any authentication requirements. An attacker can craft a malicious HTTP request targeting the import functionality endpoint, uploading a PHP file containing malicious code. Since the server does not validate the file type before accepting and storing the upload, the malicious file is placed on the server's filesystem. The attacker can then access the uploaded file directly through its URL, triggering execution of the malicious code and achieving remote code execution on the target server.

For detailed technical information about this vulnerability, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11170

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories or plugin directories
• Web server access logs showing POST requests to CPI WP Migration import endpoints from unknown IP addresses
• Presence of files with suspicious names or encoded content in the WordPress installation
• Anomalous outbound network connections from the web server indicating potential reverse shell activity

Detection Strategies

• Monitor web server access logs for unusual POST requests targeting WordPress plugin endpoints, particularly those related to file upload or import functionality
• Implement file integrity monitoring (FIM) to detect newly created or modified PHP files in WordPress directories
• Deploy web application firewalls (WAF) with rules to detect and block arbitrary file upload attempts
• Use WordPress security plugins to scan for unauthorized file modifications and known webshell signatures

Monitoring Recommendations

• Enable detailed logging for all file upload activities on the WordPress server
• Configure alerting for any new executable files created in web-accessible directories
• Monitor for unusual process spawning from web server processes (e.g., Apache, Nginx, PHP-FPM)
• Review authentication logs for any unauthorized access attempts following potential exploitation

How to Mitigate CVE-2025-11170

Immediate Actions Required

• Immediately deactivate and remove the WP移行専用プラグイン for CPI plugin if running version 1.0.2 or earlier
• Conduct a thorough scan of the WordPress installation for any suspicious files that may have been uploaded
• Review web server access logs for evidence of exploitation attempts
• Consider restoring from a known-clean backup if compromise is suspected

Patch Information

Users should check the WordPress Plugin Directory for the latest version of the plugin that addresses this vulnerability. Until a patched version is confirmed, it is strongly recommended to keep the plugin deactivated and removed from the WordPress installation.

Workarounds

• Remove or deactivate the WP移行専用プラグイン for CPI plugin completely until a patched version is available
• Implement WAF rules to block requests to the vulnerable import endpoint
• Restrict access to WordPress admin and plugin directories using web server configuration (.htaccess or Nginx rules)
• Use server-level file upload restrictions to block executable file types in WordPress directories

# Example .htaccess rule to block PHP execution in uploads directory
<Directory /var/www/html/wp-content/uploads>
    <FilesMatch "\.php$">
        Deny from all
    </FilesMatch>
</Directory>