CVE-2025-14478: Demo Importer Plus WordPress XXE Flaw

CVE-2025-14478 Overview

The Demo Importer Plus plugin for WordPress contains an XML External Entity (XXE) Injection vulnerability in all versions up to and including 2.0.9. The vulnerability exists in the SVG file upload functionality, which fails to properly sanitize XML input before processing. This allows authenticated attackers with Author-level access or above to inject malicious XML entities that can lead to code execution on vulnerable server configurations. Notably, this vulnerability only affects sites running PHP versions older than 8.0, as PHP 8.0 and later include default protections against XXE attacks.

Critical Impact

Authenticated attackers can achieve remote code execution through malicious SVG file uploads on WordPress sites running vulnerable PHP versions (< 8.0), potentially leading to complete server compromise.

Affected Products

• Demo Importer Plus WordPress plugin versions ≤ 2.0.9
• WordPress sites running PHP versions older than 8.0
• Any WordPress installation with the vulnerable plugin where Author-level or higher access is compromised

Discovery Timeline

• 2026-01-17 - CVE CVE-2025-14478 published to NVD
• 2026-01-17 - Last updated in NVD database

Technical Details for CVE-2025-14478

Vulnerability Analysis

This XXE vulnerability resides in the class-demo-importer-plus-sites-helper.php file within the Demo Importer Plus plugin. The affected code processes SVG files uploaded by authenticated users without properly disabling external entity resolution. When a malicious SVG containing an XXE payload is uploaded, the XML parser processes external entities, allowing attackers to read arbitrary files from the server, perform server-side request forgery (SSRF), or achieve code execution depending on the server configuration.

The vulnerability requires Author-level or higher WordPress privileges to exploit, as attackers need the ability to upload files to the WordPress media library. However, this authentication requirement does not significantly reduce the risk in multi-author environments or compromised credential scenarios.

Root Cause

The root cause is the failure to disable external entity loading in the XML parser configuration before processing SVG file content. PHP's libxml_disable_entity_loader() function was not called prior to parsing user-supplied SVG content, and dangerous features like LIBXML_NOENT may have been enabled. PHP versions prior to 8.0 default to allowing external entity loading, making older PHP installations particularly vulnerable.

Attack Vector

The attack is network-based and requires authenticated access with Author-level or higher privileges. An attacker would craft a malicious SVG file containing XXE payloads that reference external entities or exploit PHP wrapper protocols. When the Demo Importer Plus plugin processes this SVG during the import workflow, the malicious entities are resolved, potentially leading to:

• Disclosure of sensitive server files (e.g., /etc/passwd, wp-config.php)
• Server-Side Request Forgery (SSRF) to internal services
• Remote code execution via PHP wrapper exploitation on vulnerable configurations

The vulnerability mechanism exploits improper XML parsing in the SVG upload handler. When processing uploaded SVG files, the plugin parses XML content without disabling external entity resolution. An attacker can craft an SVG file with a DOCTYPE declaration that defines external entities pointing to local files or remote resources. Upon parsing, the XML processor resolves these entities, exposing file contents or triggering SSRF. For technical implementation details, see the WordPress Plugin Demo Importer Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-14478

Indicators of Compromise

• Unusual SVG file uploads containing DOCTYPE declarations or ENTITY definitions in the WordPress media library
• Web server logs showing requests to internal resources or localhost addresses originating from the WordPress application
• Error logs containing XML parsing errors or references to external entity resolution failures
• Unexpected file access attempts in PHP error logs, particularly targeting configuration files

Detection Strategies

• Monitor WordPress upload directories for SVG files containing suspicious XML patterns such as <!DOCTYPE, <!ENTITY, or SYSTEM keywords
• Implement Web Application Firewall (WAF) rules to detect XXE payload patterns in file upload requests
• Review WordPress user activity logs for unusual file upload behavior from Author-level accounts
• Deploy SentinelOne Singularity to detect and prevent exploitation attempts through behavioral analysis

Monitoring Recommendations

• Enable detailed PHP error logging to capture XML parsing anomalies
• Configure file integrity monitoring for WordPress core files and the wp-config.php configuration file
• Set up alerts for outbound connections from the web server to unexpected internal or external endpoints
• Monitor for privilege escalation attempts following initial compromise through the XXE vector

How to Mitigate CVE-2025-14478

Immediate Actions Required

• Update the Demo Importer Plus plugin to version 2.1.0 or later immediately
• Upgrade PHP to version 8.0 or later, which includes default XXE protections
• Review and revoke Author-level access for untrusted users until the patch is applied
• Audit recent SVG uploads for potentially malicious content

Patch Information

The vulnerability has been patched in the Demo Importer Plus plugin. The fix involves properly disabling external entity loading before processing SVG content. The security update can be reviewed in the WordPress Demo Importer Changeset Update. Site administrators should update through the WordPress plugin update mechanism or download the latest version from the WordPress Plugin Directory.

Workarounds

• Disable the Demo Importer Plus plugin entirely until the update can be applied
• Restrict SVG uploads by adding filters to WordPress to block SVG MIME types temporarily
• Implement server-level protections by configuring PHP to disable entity loading globally via php.ini
• Use a Web Application Firewall (WAF) to filter requests containing XXE payload signatures

# PHP configuration to mitigate XXE (add to php.ini)
; Disable external entity loading (for PHP < 8.0)
libxml.disable_entity_loader = On

# WordPress filter to temporarily block SVG uploads (add to functions.php)
# add_filter('upload_mimes', function($mimes) {
#     unset($mimes['svg']);
#     unset($mimes['svgz']);
#     return $mimes;
# });