CVE-2025-13145: WP Import Plugin RCE Vulnerability

CVE-2025-13145 Overview

CVE-2025-13145 is a PHP Object Injection vulnerability in the WP Import – Ultimate CSV XML Importer for WordPress plugin. The flaw affects all versions up to and including 7.33.1. The vulnerability resides in the import_single_post_as_csv function within SingleImportExport.php, where untrusted CSV file content is deserialized without validation. Authenticated attackers with administrator-level access can inject PHP objects through crafted CSV imports. When a Property-Oriented Programming (POP) chain exists in another installed plugin or theme, exploitation can lead to arbitrary file deletion, sensitive data retrieval, or remote code execution.

Critical Impact
Authenticated administrators can trigger PHP Object Injection via CSV imports, potentially leading to arbitrary file deletion, data exfiltration, or code execution when a POP chain is present.

Affected Products

WP Import – Ultimate CSV XML Importer for WordPress plugin
All versions through 7.33.1
WordPress installations with the affected plugin activated alongside plugins or themes containing usable POP gadgets

Discovery Timeline

2025-11-19 - CVE-2025-13145 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13145

Vulnerability Analysis

The vulnerability is classified under [CWE-502]: Deserialization of Untrusted Data. The plugin processes user-supplied CSV file content through PHP's unserialize() mechanism inside the import_single_post_as_csv function. Because the input originates from an uploaded CSV that the plugin treats as trusted, an attacker can place a serialized PHP object payload into a field that is later deserialized.

PHP Object Injection alone does not guarantee code execution. Exploitation requires a POP gadget chain — magic methods such as __destruct, __wakeup, or __toString in classes loaded by WordPress core, the active theme, or other installed plugins. Once a usable chain exists, the deserialization sink turns into a primitive for file deletion, file read, or code execution depending on the gadget.

Root Cause

The root cause is the use of unsafe deserialization on attacker-controlled CSV content within SingleImportExport.php at the import handler. The function does not enforce strict typing, schema validation, or safe parsing through json_decode or igbinary_unserialize with allowed classes. Any serialized object string supplied in a CSV cell reaches unserialize() unfiltered.

Attack Vector

The attack vector is network-based but requires high privileges. An attacker must already possess administrator credentials, obtained through credential theft, session hijacking, or compromise of a privileged account. The attacker uploads a CSV file containing a serialized PHP object in a field consumed by import_single_post_as_csv. When the plugin parses the import, the object is reconstructed and any magic methods on gadget classes execute, completing the chain.

No public proof-of-concept is currently listed in the references. Technical context is available through the WordPress Plugin Code Review, the WordPress Plugin Changeset, and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13145

Indicators of Compromise

CSV files uploaded to wp-content/uploads/ or the plugin's import directory containing serialized PHP object markers such as O: followed by class name and length
Unexpected file deletions, new PHP files, or modifications under wp-content/ shortly after a CSV import event
Administrator account activity from unfamiliar IP addresses immediately preceding an import operation
WordPress error logs showing __destruct, __wakeup, or autoloader entries triggered during plugin import requests

Detection Strategies

Inspect CSV uploads for the byte patterns O:<digit>: and a:<digit>:{ that indicate serialized PHP objects or arrays in import fields
Audit WordPress access logs for POST requests to admin pages invoking the Ultimate CSV Importer with attached file payloads
Compare installed plugin versions against 7.33.1 and flag any host still running a vulnerable build

Monitoring Recommendations

Forward WordPress audit logs and PHP error logs into a centralized log platform and alert on deserialization-related stack traces
Monitor file integrity on wp-content/plugins/, wp-content/themes/, and wp-config.php for unexpected writes or deletions
Track administrator logins and CSV import actions with user, source IP, and timestamp correlation

How to Mitigate CVE-2025-13145

Immediate Actions Required

Update the WP Import – Ultimate CSV XML Importer plugin to a version newer than 7.33.1 as soon as the vendor publishes a fixed release
Restrict administrator accounts to trusted personnel and enforce multi-factor authentication on all privileged WordPress users
Review recent CSV imports and rotate any secrets stored in wp-config.php if compromise is suspected

Patch Information

The vendor changeset addressing this issue is published at the WordPress Plugin Changeset. Administrators should apply the fixed plugin version through the WordPress dashboard or by replacing the plugin directory with the patched release.

Workarounds

Deactivate and remove the Ultimate CSV XML Importer plugin until a patched version is installed
Limit which administrator accounts can perform CSV imports by using a role-management plugin to revoke the import capability
Place the WordPress admin interface behind an IP allowlist or VPN to reduce exposure of the import endpoint

bash

# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate wp-ultimate-csv-importer
wp plugin status wp-ultimate-csv-importer