CVE-2025-13065: Starter Templates WordPress Plugin RCE Flaw

CVE-2025-13065 Overview

The Starter Templates plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 4.4.41. The flaw stems from insufficient file type validation when detecting WordPress eXtended RSS (WXR) files. Attackers can craft files with double extensions to bypass sanitization while the plugin accepts them as valid WXR imports. Authenticated users with author-level access or higher can exploit this weakness to upload arbitrary files to the affected site. Successful exploitation may lead to remote code execution on the underlying server. The vulnerability is categorized under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers with author-level privileges can upload arbitrary files and potentially achieve remote code execution on affected WordPress sites.

Affected Products

Starter Templates plugin for WordPress (also known as Astra Sites / Astra Importer)
All versions up to and including 4.4.41
Fixed in version 4.4.42

Discovery Timeline

2025-12-06 - CVE-2025-13065 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13065

Vulnerability Analysis

The Starter Templates plugin provides a one-click import mechanism for WordPress site templates. Imports rely on the WordPress eXtended RSS (WXR) format, an XML-based content export structure. The plugin exposes an import handler in st-wxr-importer.php that accepts uploaded files for processing.

The vulnerability is a classic [CWE-434] Unrestricted Upload of File with Dangerous Type. The plugin's WXR detection routine inspects only a portion of the filename rather than enforcing strict extension validation against an allowlist. As a result, files named with double extensions such as payload.php.wxr or shell.wxr.php satisfy the WXR detection logic while remaining executable as PHP on the server. The upload is stored within the WordPress uploads directory and becomes reachable through the web server.

Root Cause

The root cause is incomplete file type validation. The importer relies on substring or loose pattern matching to identify WXR files instead of validating the final filename extension and the file's MIME type. Combined with the absence of content-based sanitization, this allows an attacker-controlled PHP payload to pass through the import flow.

Attack Vector

Exploitation requires an authenticated session with at least author-level capabilities. The attacker uploads a crafted file with a double extension to the plugin's import endpoint. After the file is stored within the web root, the attacker requests its URL directly, causing PHP to execute the payload. This grants code execution in the context of the web server user and can be used to pivot, persist, or exfiltrate data.

No verified exploit code is publicly available. See the Wordfence Vulnerability Report and the WordPress Astra Importer Update for the corrected validation logic.

Detection Methods for CVE-2025-13065

Indicators of Compromise

Files with double extensions such as *.php.wxr, *.wxr.php, or similar combinations inside wp-content/uploads/ directories.
New or unexpected PHP files appearing in upload paths used by the Starter Templates / Astra Sites plugin.
WordPress audit log entries showing WXR imports initiated by author-level accounts that do not normally perform imports.
Outbound network connections from the web server process to unfamiliar hosts following an import event.

Detection Strategies

Inventory WordPress sites and identify those running the Starter Templates plugin at version 4.4.41 or earlier.
Monitor HTTP POST requests to plugin import endpoints and correlate them with subsequent GET requests targeting newly created files in upload directories.
Scan the file system for PHP files within wp-content/uploads/ and flag any matches with double extensions.
Review WordPress user roles to identify low-privileged accounts that should not retain upload or import permissions.

Monitoring Recommendations

Forward web server access logs and WordPress audit logs to a centralized logging platform for correlation.
Alert on PHP execution originating from upload directories, which should normally be blocked by web server configuration.
Track authentication events for author and editor accounts, particularly logins from new IP addresses or geolocations.
Establish baselines for plugin import activity and alert on deviations.

How to Mitigate CVE-2025-13065

Immediate Actions Required

Update the Starter Templates plugin to version 4.4.42 or later on all WordPress installations.
Audit all author-level and higher accounts and remove or downgrade any that are unnecessary.
Inspect wp-content/uploads/ for unexpected PHP files and remove confirmed malicious artifacts.
Rotate WordPress credentials and API keys if exploitation is suspected.

Patch Information

The vendor released a fix in version 4.4.42. The corrected validation logic is published in the WordPress Astra Importer Update. Administrators should apply the update through the WordPress plugin manager or by deploying the patched release directly.

Workarounds

Deactivate the Starter Templates plugin until the patched version can be installed.
Enforce least privilege by restricting author-level and higher roles to trusted users only.
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules.
Place a web application firewall in front of WordPress to block requests carrying double-extension filenames to plugin import endpoints.

bash

# Apache: deny PHP execution within the WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phar|phtml)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phar|phtml)$ {
    deny all;
    return 403;
}