CVE-2025-13066: WordPress Demo Importer Plus RCE Flaw

CVE-2025-13066 Overview

CVE-2025-13066 is an arbitrary file upload vulnerability in the Demo Importer Plus plugin for WordPress, affecting all versions up to and including 2.0.6. The plugin performs insufficient file type validation when detecting WordPress eXtended RSS (WXR) files. Attackers can craft files with double extensions that bypass sanitization while still passing the WXR validation check. Authenticated users with author-level access or higher can upload arbitrary files to the server. Successful exploitation can lead to remote code execution on the affected WordPress site. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers with author-level access can upload malicious PHP files disguised with double extensions, enabling remote code execution and full site compromise.

Affected Products

Demo Importer Plus plugin for WordPress, all versions through 2.0.6
WordPress sites where authenticated users hold author-level or higher privileges
Web servers executing PHP files from WordPress upload directories

Discovery Timeline

2025-12-05 - CVE-2025-13066 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13066

Vulnerability Analysis

The Demo Importer Plus plugin handles WXR imports through routines under inc/importers. The import logic identifies WXR files using a check that does not properly enforce a single, safe extension. An attacker can submit a file named with a double extension such as payload.php.wxr or payload.wxr.php, depending on how the parser and the underlying web server resolve the filename. The validation accepts the file as a legitimate WXR import while the server later treats the file as executable PHP. This combination of weak validation and permissive upload handling produces an arbitrary file upload condition that escalates into remote code execution.

Root Cause

The root cause is insufficient file type validation in the WXR import handler. The plugin inspects only one portion of the filename or the apparent content type rather than enforcing strict allow-listed extensions and rejecting filenames containing multiple extensions. Sanitization does not strip or block secondary extensions that map to executable handlers in the web server configuration. The fix is delivered in changeset 3400301 to the plugin trunk under inc/importers. See the WordPress Plugin Changeset and the Wordfence Vulnerability Analysis for detailed technical context.

Attack Vector

The attack is network-based and requires authentication at the author role or higher. An attacker first obtains or compromises an account with the required privileges. The attacker then submits a crafted file to the plugin's import endpoint using a double-extension filename that satisfies the WXR check. After upload, the attacker requests the file directly through the web server, which executes the embedded PHP code. The result is arbitrary command execution under the web server user, leading to full site takeover, data theft, or lateral movement.

Detection Methods for CVE-2025-13066

Indicators of Compromise

Files in WordPress upload directories with double extensions such as .php.wxr, .wxr.php, .phtml.wxr, or other executable handler combinations.
Unexpected PHP files written under wp-content/uploads/ shortly after a Demo Importer Plus import action.
HTTP POST requests to Demo Importer Plus import endpoints from author-level accounts followed by direct GET requests to newly created files.
New or modified author accounts performing import actions outside normal site administration windows.

Detection Strategies

Audit installed WordPress plugins and flag any Demo Importer Plus installation at version 2.0.6 or earlier.
Inspect web server access logs for sequences where an authenticated import is followed by direct execution of a file inside wp-content/uploads/.
Use file integrity monitoring on the WordPress filesystem to identify newly written PHP, .phtml, or similar executable files.
Search for filenames containing more than one extension across the WordPress document root.

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized log platform and alert on POSTs to plugin import endpoints from non-administrator roles.
Monitor process telemetry on web hosts for PHP child processes spawning shells, package managers, or outbound network connections.
Track creation of executable files in upload directories and alert on any write that produces a .php extension.

How to Mitigate CVE-2025-13066

Immediate Actions Required

Update the Demo Importer Plus plugin to a version newer than 2.0.6 that includes the fix from changeset 3400301.
Review all author-level and higher accounts, rotate passwords, and remove unused or unknown accounts.
Scan wp-content/uploads/ for files with double extensions or unexpected PHP content and remove confirmed malicious artifacts.
Restore from a known-good backup if remote code execution is suspected and forensic triage cannot fully verify integrity.

Patch Information

The vendor fix is published in the plugin trunk under changeset 3400301, which updates the importer logic in inc/importers. Site administrators should install the latest plugin release from the WordPress plugin repository to apply this fix.

Workarounds

Deactivate and remove the Demo Importer Plus plugin until the patched version is installed.
Restrict the author role and above to trusted users only, and require multi-factor authentication for these accounts.
Configure the web server to deny execution of PHP within wp-content/uploads/ using directory-level rules.
Place a web application firewall in front of WordPress and block requests containing multi-extension filenames targeting plugin import endpoints.

bash

# Example Nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}