Platform
wordpress
Component
wp-ultimate-csv-importer
Fixed in
7.28.1
CVE-2025-10057 is a critical Remote Code Execution (RCE) vulnerability affecting the WP Import – Ultimate CSV XML Importer for WordPress plugin. An attacker with Subscriber-level access or higher can inject malicious PHP code, potentially gaining complete control of the WordPress site. This vulnerability impacts versions 7.20 through 7.28. A patch is expected to be released by the plugin developer.
This RCE vulnerability allows an authenticated attacker to execute arbitrary code on the server hosting the WordPress site. The attack vector involves manipulating the customFunction.php file, which is then executed by the plugin. Successful exploitation could lead to complete compromise of the website, including data theft, modification, and defacement. The attacker could also leverage the compromised server to launch further attacks against other systems within the network, significantly expanding the blast radius. This vulnerability shares similarities with other plugin-based RCE vulnerabilities where file uploads or modifications are not properly sanitized.
This vulnerability was publicly disclosed on 2025-09-17. The CVSS score is 8.8 (HIGH). There are currently no known public exploits, but the ease of exploitation suggests a high probability of exploitation if left unpatched. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns. This vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.35% (58% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to immediately upgrade the WP Import plugin to a version containing the fix, once released by the developer. As an interim measure, restrict file upload permissions for users with Subscriber roles or lower. Implement a Web Application Firewall (WAF) rule to block attempts to upload or modify the customFunction.php file. Regularly scan the WordPress installation for suspicious files and modifications. Review user roles and permissions to ensure the principle of least privilege is enforced.
Actualice el plugin WP Import – Ultimate CSV XML Importer for WordPress a la última versión disponible. Esto solucionará la vulnerabilidad de ejecución remota de código.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-10057 is a Remote Code Execution vulnerability in the WP Import plugin for WordPress, allowing authenticated attackers to execute arbitrary code.
You are affected if you are using WP Import versions 7.20 through 7.28 and have not upgraded to a patched version.
Upgrade the WP Import plugin to the latest available version as soon as a patch is released by the developer. Implement WAF rules and restrict file upload permissions as interim measures.
While no public exploits are currently known, the ease of exploitation suggests a high probability of exploitation if left unpatched.
Refer to the official WP Import plugin website and WordPress security announcements for the latest advisory and patch information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.