CVE-2025-6207: WP Import Export Lite RCE Vulnerability

CVE-2025-6207 Overview

CVE-2025-6207 is an arbitrary file upload vulnerability in the WP Import Export Lite plugin for WordPress. The flaw exists in the wpie_tempalte_import function, which fails to validate file types before accepting uploads. All plugin versions up to and including 3.9.28 are affected.

Authenticated users with Subscriber-level access or higher can exploit this issue when granted permissions by an Administrator. Successful exploitation allows attackers to upload arbitrary files to the server, potentially leading to remote code execution. The vulnerability is classified under CWE-434 Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can upload arbitrary files and achieve remote code execution on WordPress sites running vulnerable versions of WP Import Export Lite.

Affected Products

Vjinfotech WP Import Export Lite plugin for WordPress
All versions up to and including 3.9.28
WordPress sites where Administrators grant import permissions to Subscriber-level users or higher

Discovery Timeline

2025-08-05 - CVE-2025-6207 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6207

Vulnerability Analysis

The vulnerability resides in the wpie_tempalte_import function inside includes/classes/class-wpie-common-action.php. The function processes uploaded template files but omits server-side validation of file extensions and MIME types. Attackers can submit files with executable extensions such as .php instead of expected template formats.

The attack requires authentication and Subscriber-level access at minimum. Administrators must also grant the user import permissions for the plugin. Once these conditions are met, the attacker submits a crafted request to the import endpoint with a malicious payload.

The EPSS score is 0.613% with a percentile of 44.667, indicating moderate exploitation probability. No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing input validation on uploaded files. The wpie_tempalte_import function accepts user-supplied files without checking the extension, MIME type, or content signature against an allowlist. This violates the secure file upload pattern required for any WordPress plugin handling user-supplied files.

Attack Vector

The attack vector is network-based through the WordPress administrative interface. An authenticated user with appropriate import permissions sends a POST request containing a PHP webshell disguised as a template file. The server stores the file in a web-accessible directory, allowing the attacker to invoke the script and execute arbitrary PHP code under the web server's user context.

Technical details are available in the WordPress Plugin Code Snippet and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6207

Indicators of Compromise

Unexpected .php, .phtml, or .phar files in the WP Import Export Lite upload directories
HTTP POST requests targeting the wpie_tempalte_import AJAX action with non-template file payloads
New or modified PHP files in wp-content/uploads/ with recent timestamps not associated with legitimate uploads
Outbound network connections from the web server process to unfamiliar hosts following import activity

Detection Strategies

Monitor WordPress AJAX endpoints for calls referencing wpie_tempalte_import from non-administrator accounts
Inspect file uploads for mismatches between declared content type and actual file signature
Audit WordPress role assignments to identify Subscriber accounts with elevated import permissions
Review web server access logs for POST requests followed by GET requests to newly created files in upload paths

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation, especially wp-content/uploads/ and plugin directories
Forward WordPress audit logs and web server logs to a central SIEM for correlation
Alert on PHP file creation within upload directories, which should not normally contain executable code
Track plugin version inventory across WordPress installations to identify systems still running 3.9.28 or earlier

How to Mitigate CVE-2025-6207

Immediate Actions Required

Update WP Import Export Lite to a version newer than 3.9.28 that contains the fix from WordPress Change Set #3323402
Review user roles and revoke import permissions from any Subscriber-level accounts that do not require them
Scan wp-content/uploads/ and plugin directories for unauthorized PHP files and remove them
Rotate WordPress administrator and database credentials if compromise is suspected

Patch Information

The vendor addressed the vulnerability in WordPress Change Set #3323402. The patch adds file type validation to the wpie_tempalte_import function. Administrators should apply the update through the WordPress plugin manager or download the latest version from the WordPress plugin repository.

Workarounds

Deactivate the WP Import Export Lite plugin until the patched version can be installed
Restrict import functionality to trusted Administrator accounts only and remove Subscriber-level access
Deploy a web application firewall rule that blocks PHP file uploads to plugin endpoints
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level restrictions

bash

# Apache .htaccess example to block PHP execution in uploads
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7)$">
    Require all denied
</FilesMatch>