CVE-2025-12733: WP All Import Plugin RCE Vulnerability

CVE-2025-12733 Overview

CVE-2025-12733 is a Remote Code Execution (RCE) vulnerability in the Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress. The flaw affects all versions up to and including 3.9.6. It stems from the use of eval() on unsanitized user-supplied input within the pmxi_if function in helpers/functions.php. Authenticated attackers with import capabilities, typically administrators, can inject and execute arbitrary PHP code on the server through crafted import templates. The issue is classified under CWE-94 (Improper Control of Generation of Code).

Critical Impact
Authenticated administrators can execute arbitrary PHP code on the underlying server, leading to full WordPress site compromise.

Affected Products

Import any XML, CSV or Excel File to WordPress (WP All Import) plugin — all versions through 3.9.6
WordPress installations with the WP All Import plugin enabled
Multisite WordPress environments where the plugin is network-activated

Discovery Timeline

2025-11-13 - CVE-2025-12733 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12733

Vulnerability Analysis

The vulnerability resides in the pmxi_if helper function inside helpers/functions.php of the WP All Import plugin. This function evaluates conditional logic supplied through import templates by passing the expression directly to PHP's eval() construct. Because the function does not sanitize, validate, or restrict the input, any PHP code embedded in the conditional expression executes within the WordPress process context. Attackers can leverage this to spawn web shells, exfiltrate database credentials from wp-config.php, or pivot into the wider hosting environment. The Wordfence advisory and the public plugin source in the WordPress Plugin Trac confirm the vulnerable code path at line 79 of functions.php.

Root Cause

The root cause is the use of eval() against attacker-controllable string data without an allow-list of permitted tokens or operators. The pmxi_if function was designed to support template authors writing conditional import rules, but it does not differentiate between safe arithmetic or comparison expressions and full PHP statements. Any user permitted to create or modify an import template can therefore inject PHP function calls such as system(), passthru(), or file_put_contents().

Attack Vector

Exploitation requires authenticated access with import capabilities, which the plugin grants to administrators by default. An attacker logs in, navigates to the WP All Import interface, and crafts an import template containing a conditional expression with embedded PHP. When the import runs, the malicious payload reaches pmxi_if, where eval() executes it on the server. The attack is remotely reachable over the network through the standard WordPress admin interface and does not require user interaction beyond the attacker's own authenticated session.

No verified public proof-of-concept code is referenced in the advisory. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the vulnerable source line.

Detection Methods for CVE-2025-12733

Indicators of Compromise

Unexpected PHP files written under wp-content/uploads/wpallimport/ or other plugin working directories.
New or modified WordPress administrator accounts created near the time of an import job execution.
Outbound network connections from the PHP-FPM or web server process to unfamiliar hosts following template imports.
Entries in WP All Import logs referencing conditional expressions that contain PHP function names such as system, exec, base64_decode, or assert.

Detection Strategies

Inspect import templates stored in the database table wp_pmxi_imports for suspicious PHP tokens within conditional fields.
Monitor web server access logs for POST requests to admin.php?page=pmxi-admin-import or admin-ajax.php actions tied to WP All Import.
Alert on PHP processes spawning shells (/bin/sh, bash, cmd.exe) as a child of the web server user.
Compare the live helpers/functions.php against the official plugin checksum to detect tampering or backdoored versions.

Monitoring Recommendations

Enable file integrity monitoring across the WordPress document root, with priority on wp-content/plugins/wp-all-import/ and the uploads directory.
Forward WordPress audit logs and PHP error logs to a centralized SIEM for correlation with web access telemetry.
Review administrator session activity weekly and flag accounts that create or run import templates without a business reason.

How to Mitigate CVE-2025-12733

Immediate Actions Required

Update the WP All Import plugin to the latest patched release published after version 3.9.6.
Audit all WordPress administrator accounts and revoke access for unused or unknown users.
Review existing import templates and delete any that contain unfamiliar conditional expressions before running them.
Rotate WordPress secrets in wp-config.php and database credentials if compromise is suspected.

Patch Information

The vendor addressed the issue in a release tracked in the WordPress Plugin Change Log. Administrators should upgrade through the WordPress plugin management interface or by deploying the fixed package from the official plugin repository. Verify the installed version after upgrade to confirm remediation.

Workarounds

Temporarily deactivate the WP All Import plugin until the patched version is deployed.
Restrict administrator capabilities so that only a small set of vetted accounts can run imports.
Apply a Web Application Firewall (WAF) rule that blocks POST parameters containing PHP function tokens targeting WP All Import endpoints.
Enforce multi-factor authentication on all WordPress administrator accounts to reduce the risk of credential-based access.

bash

# Example: disable the plugin via WP-CLI until patching is complete
wp plugin deactivate wp-all-import --all
wp plugin status wp-all-import