WordPress Ultra Demo Importer plugin <= 1.0.5 - CSRF to RCE vulnerability

The primary impact of CVE-2025-32496 is the ability for an attacker to execute arbitrary code on a vulnerable WordPress server. By exploiting the Cross-Site Request Forgery (CSRF) vulnerability in the Ultra Demo Importer, an attacker can upload a malicious web shell. This web shell provides a persistent backdoor, enabling the attacker to execute commands, access sensitive data (including database credentials, user information, and potentially other connected systems), and potentially pivot to other systems on the network. The blast radius extends to any data stored on the server and any services accessible from it. This vulnerability shares similarities with other web shell upload vulnerabilities, where attackers gain persistent access and control over the compromised system.

WordPress websites utilizing the Ultra Demo Importer plugin, particularly those running vulnerable versions (0.0.0–1.0.5), are at significant risk. Shared hosting environments are especially vulnerable as they often have limited control over plugin updates and security configurations. Websites with less stringent file upload policies are also more susceptible to exploitation.

• wordpress / composer / npm:

wp plugin list | grep Ultra Demo Importer

• wordpress / composer / npm:

wp plugin update --all

• generic web: Check WordPress plugin directory for version 1.0.6 or higher. • wordpress / composer / npm:

wp plugin status ut-demo-importer

1. 2025-04-09Disclosure

   disclosure

1. Reserviert2025-04-09
2. Veröffentlicht2025-04-09
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-32496 is to immediately upgrade the Ultra Demo Importer plugin to version 1.0.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting file upload permissions within the WordPress environment, implementing stricter CSRF protection measures (if possible without breaking plugin functionality), and closely monitoring server logs for suspicious activity. Web Application Firewalls (WAFs) can be configured to block requests containing malicious file uploads. After upgrading, verify the fix by attempting to upload a test file through the plugin's importer functionality; the upload should be rejected.