CVE-2025-12894: Import WP Plugin Information Disclosure

CVE-2025-12894 Overview

The Import WP – Export and Import CSV and XML files to WordPress plugin contains a sensitive information exposure vulnerability affecting all versions up to and including 2.14.17. The flaw stems from missing .htaccess protection on the /exportwp and /importwp directories used by the plugin's import/export functionality. Unauthenticated remote attackers can access these directories over the network and retrieve stored export data and import data without authentication. The issue is tracked as CWE-552: Files or Directories Accessible to External Parties.

Critical Impact
Unauthenticated attackers can retrieve sensitive data from WordPress sites where the Import WP plugin has stored user records, product data, or other imported and exported CSV/XML content.

Affected Products

Import WP – Export and Import CSV and XML files plugin for WordPress
All versions up to and including 2.14.17
WordPress sites where imported or exported files remain in /exportwp and /importwp directories

Discovery Timeline

2025-11-21 - CVE-2025-12894 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12894

Vulnerability Analysis

The Import WP plugin writes exported data files into a /exportwp directory and stores uploaded import data in /importwp. Both directories reside under the WordPress uploads path and are served directly by the web server. The plugin does not deploy a .htaccess file, index restrictions, or equivalent access controls on these locations. As a result, any remote user who knows or guesses the file naming pattern can request the content directly over HTTP or HTTPS. The exposure is limited to confidentiality; the vulnerability does not affect integrity or availability of the WordPress instance.

Root Cause

The root cause is missing access control on generated file artifacts, classified under [CWE-552]. The plugin relies on filename obscurity rather than server-level restrictions to protect files that may contain personal data, product catalogs, order histories, or other business content. Because WordPress uploads are typically web-accessible by design, the absence of a directory-level .htaccess deny rule allows direct retrieval.

Attack Vector

An unauthenticated attacker sends HTTP requests to predictable paths such as /wp-content/uploads/exportwp/ or /wp-content/uploads/importwp/ and enumerates file names generated by the plugin. When directory listing is enabled or file names follow a predictable pattern, the attacker retrieves the CSV or XML content directly. No credentials, user interaction, or elevated privileges are required. See the Wordfence vulnerability report for additional context.

Detection Methods for CVE-2025-12894

Indicators of Compromise

Unauthenticated HTTP GET requests targeting /wp-content/uploads/exportwp/ or /wp-content/uploads/importwp/ paths
Web server access logs showing successful 200 responses for .csv or .xml files under these directories from external IP addresses
Directory index responses returned from /exportwp or /importwp when browsed directly
Sudden spikes in bandwidth associated with the WordPress uploads directory

Detection Strategies

Audit web server access logs for anonymous requests to the exportwp and importwp upload subdirectories
Run authenticated and unauthenticated crawls against the site to confirm which files are externally reachable
Query the plugin version through wp plugin list and flag installations at or below version 2.14.17

Monitoring Recommendations

Alert on any HTTP request to /wp-content/uploads/exportwp/ or /wp-content/uploads/importwp/ originating outside administrative IP ranges
Track download volume for CSV and XML files served from WordPress uploads
Correlate access log anomalies with WordPress plugin inventory data to identify vulnerable hosts

How to Mitigate CVE-2025-12894

Immediate Actions Required

Update the Import WP plugin to a version newer than 2.14.17 once the vendor publishes a fix
Manually deploy .htaccess rules or web server configuration blocks that deny direct access to /wp-content/uploads/exportwp/ and /wp-content/uploads/importwp/
Remove or relocate any existing export and import files that contain sensitive data from the uploads directory
Review web server logs for prior unauthorized access to these paths and notify affected data subjects if disclosure occurred

Patch Information

Refer to the WordPress Plugin Change Log for the code changes associated with this issue. Site administrators should apply the latest available plugin release and confirm that .htaccess protection is installed on the export and import directories after upgrade.

Workarounds

Add an Apache .htaccess file to both directories containing Require all denied (Apache 2.4) or Deny from all (Apache 2.2)
On Nginx, add a location block returning 403 for requests to the exportwp and importwp paths
Disable directory listing globally with Options -Indexes in the web server configuration
Move completed export files off the web root immediately after generation

bash

# Apache .htaccess to block direct access to Import WP directories
# Place in /wp-content/uploads/exportwp/.htaccess and /wp-content/uploads/importwp/.htaccess
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>

# Nginx equivalent (add to server block)
# location ~* /wp-content/uploads/(exportwp|importwp)/ {
#     deny all;
#     return 403;
# }