CVE-2025-4954: Axle Demo Importer RCE Vulnerability

CVE-2025-4954 Overview

CVE-2025-4954 affects the Axle Demo Importer WordPress plugin through version 1.0.3. The plugin fails to validate files submitted to its import endpoint. Authenticated users with author-level privileges or higher can upload arbitrary files, including PHP scripts, to the server. Once uploaded, attackers can execute these scripts within the web server context to achieve remote code execution. The flaw maps to CWE-434 (Unrestricted Upload of File with Dangerous Type) and is tracked by WPScan.

Critical Impact
Authenticated authors can upload PHP webshells, leading to full site compromise and lateral movement into the hosting environment.

Affected Products

Axlethemes Axle Demo Importer WordPress plugin versions through 1.0.3
WordPress sites granting author or higher roles to untrusted accounts
Hosting environments running vulnerable Axle Demo Importer installations

Discovery Timeline

2025-06-10 - CVE-2025-4954 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4954

Vulnerability Analysis

The Axle Demo Importer plugin exposes an import handler that accepts files from authenticated users. The handler does not enforce MIME type checks, extension allowlists, or content inspection before writing uploaded files to disk. Authors and higher-privileged users can submit .php files through the import workflow. The web server then serves these files, allowing attackers to execute arbitrary PHP code under the WordPress process identity.

This pattern is classic unrestricted file upload, classified under CWE-434. Successful exploitation yields full read and write access to the WordPress database, configuration files, and any credentials stored on the host.

The EPSS probability sits at roughly 0.495%, indicating limited observed exploitation activity at this time. However, the low attack complexity and broad WordPress plugin attack surface make opportunistic scanning likely once a public proof-of-concept appears.

Root Cause

The importer accepts user-supplied archives or files without validating that uploaded content matches expected demo content types. There is no server-side check confirming file extension, content type, or magic bytes match a safe allowlist before the file is stored within the WordPress uploads directory.

Attack Vector

An attacker first obtains author-level credentials, either through phishing, credential stuffing, or by registering on sites that grant authoring permissions automatically. The attacker then submits a crafted PHP file to the plugin's import endpoint. Once written to a web-accessible path, the attacker requests the file directly to trigger execution and establish a webshell.

No verified public exploit code is currently available. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-4954

Indicators of Compromise

New .php files appearing within wp-content/uploads/ or plugin-managed import directories after authenticated sessions
Outbound connections from the web server to unfamiliar IP addresses shortly after import activity
HTTP POST requests to Axle Demo Importer endpoints originating from author-level accounts not previously associated with imports
Webshell artifacts such as eval(, base64_decode(, or system( strings inside files under WordPress upload paths

Detection Strategies

Inspect WordPress access logs for POST requests to import handlers followed by GET requests to newly created PHP files
Hash and inventory PHP files under the uploads directory, alerting on any additions outside the deployment pipeline
Monitor process creation events spawned by the PHP-FPM or web server user for unexpected shell commands

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and plugin import directories
Forward WordPress audit logs and web server logs to a centralized SIEM for correlation
Track role assignments and flag accounts elevated to author or higher outside of approved workflows

How to Mitigate CVE-2025-4954

Immediate Actions Required

Deactivate and remove the Axle Demo Importer plugin until a patched version is verified by the vendor
Audit all author-level and higher WordPress accounts and reset credentials for any suspicious users
Scan the WordPress installation and uploads directory for unauthorized PHP files and remove confirmed webshells
Review web server and WordPress logs for evidence of prior exploitation

Patch Information

No fixed version has been published in the available references at the time of writing. All releases through 1.0.3 are affected. Monitor the WPScan Vulnerability Report and the vendor's plugin page for updates.

Workarounds

Remove the plugin entirely if demo import functionality is not required
Restrict author and contributor registration on production sites and require administrator approval for elevated roles
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
Place the site behind a web application firewall with rules that block PHP file uploads to plugin import endpoints

bash

# Apache: deny PHP execution in WordPress uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar)$">
    Require all denied
</FilesMatch>