CVE-2025-5061: WP Import Export Lite RCE Vulnerability

CVE-2025-5061 Overview

CVE-2025-5061 affects the WP Import Export Lite plugin for WordPress, developed by vjinfotech. The vulnerability stems from missing file type validation in the wpie_parse_upload_data function. All versions up to and including 3.9.29 are affected. Authenticated attackers with Subscriber-level access or above, when granted permissions by an administrator, can upload arbitrary files to the server. Successful exploitation may lead to remote code execution on the affected WordPress installation. The issue is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type]. The vendor released a partial patch in version 3.9.29, with additional remediation tracked in subsequent changesets.

Critical Impact
Authenticated users with low privileges can upload arbitrary files, enabling remote code execution and full compromise of the WordPress site.

Affected Products

vjinfotech WP Import Export Lite plugin for WordPress, all versions up to and including 3.9.29
WordPress sites where the plugin is installed and active
Sites where administrators have delegated plugin permissions to Subscriber or higher roles

Discovery Timeline

2025-08-05 - CVE-2025-5061 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5061

Vulnerability Analysis

The WP Import Export Lite plugin provides import and export functionality for WordPress content. The wpie_parse_upload_data function processes uploads but fails to validate the file type or extension against an allowlist of safe formats. This omission allows authenticated users to submit files containing executable PHP code through the plugin's upload handler. Once written to a web-accessible directory, the attacker can request the file directly to trigger code execution within the WordPress process context. The attack chain converts a low-privilege account into full server-side code execution, putting site data, credentials stored in wp-config.php, and any connected services at risk.

Root Cause

The root cause is the absence of MIME type and extension validation in the wpie_parse_upload_data function within class-wpie-upload-validate.php. The function accepts uploaded files without verifying that the content matches an approved import format such as CSV or XML. Reference the affected lines in the WordPress Plugin Code Review at line 24 and line 89.

Attack Vector

The attack requires network access and an authenticated session with Subscriber-level privileges or higher. An administrator must also grant the account access to the plugin's import features. The attacker submits a crafted upload request containing a PHP payload disguised as an import file. Because the handler does not enforce file type restrictions, the payload is written to a location accessible by the web server. A follow-up HTTP request executes the uploaded file, yielding remote code execution.

No verified public exploit code is available for this vulnerability. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-5061

Indicators of Compromise

Unexpected .php, .phtml, or .phar files in WordPress upload directories, particularly under wp-content/uploads/ paths used by the import plugin
HTTP POST requests to WP Import Export Lite endpoints containing non-standard file extensions in the upload payload
Outbound network connections originating from the PHP-FPM or web server process to unfamiliar hosts following an import operation
New or modified WordPress users, scheduled tasks, or wp_options entries created shortly after a plugin upload event

Detection Strategies

Monitor web server access logs for POST requests targeting WP Import Export Lite admin-ajax actions followed by GET requests to files in the uploads directory
Deploy file integrity monitoring on wp-content/uploads/ to alert on creation of executable script files
Inspect PHP execution telemetry for processes spawned by the web server that invoke shells, curl, wget, or base64 decoding routines

Monitoring Recommendations

Enable WordPress audit logging to track plugin activity and role assignments by administrators
Alert when low-privilege accounts trigger import workflows or upload large or unusual files
Correlate web server logs with endpoint telemetry to identify post-upload command execution

How to Mitigate CVE-2025-5061

Immediate Actions Required

Update WP Import Export Lite to the latest version that fully remediates the issue, beyond the partial patch in 3.9.29
Audit user roles and revoke plugin permissions granted to Subscriber, Contributor, and Author accounts where they are not required
Scan wp-content/uploads/ for unauthorized PHP files and remove any that are not part of legitimate content
Rotate WordPress administrator credentials and database secrets if exploitation is suspected

Patch Information

The vendor partially patched the vulnerability in version 3.9.29. Review the official remediation in WordPress Changeset #3323402 and WordPress Changeset #3338701. Administrators should apply the most recent release available from the WordPress plugin repository to ensure complete coverage.

Workarounds

Deactivate the WP Import Export Lite plugin until a fully patched version is installed
Restrict plugin access through capability management so that only trusted administrator accounts can perform imports
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
Place a web application firewall in front of the WordPress site to filter requests carrying executable payloads to plugin endpoints

bash

# Apache configuration example to block PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php\d)$">
        Require all denied
    </FilesMatch>
</Directory>