Platform
wordpress
Component
wing-migrator
Fixed in
1.2.1
CVE-2025-52835 describes a critical Cross-Site Request Forgery (CSRF) vulnerability discovered in the WING WordPress Migrator plugin. This flaw allows an attacker to upload a malicious web shell to a vulnerable WordPress server, potentially leading to complete site compromise. The vulnerability affects versions from 0.0.0 through 1.2.0, and a fix is available in version 2.0.0.
The impact of this CSRF vulnerability is severe. An attacker who can craft a malicious request can leverage it to upload a web shell, effectively gaining remote code execution (RCE) on the targeted WordPress server. This allows the attacker to take complete control of the website, steal sensitive data (user credentials, database information, customer data), modify website content, and potentially pivot to other systems on the network. The ability to upload arbitrary code bypasses standard WordPress security measures and represents a significant threat to website integrity and confidentiality. Successful exploitation could lead to defacement, data breaches, and denial of service.
The vulnerability was published on 2025-12-30. Currently, there is no indication of active exploitation campaigns targeting CVE-2025-52835. However, given the ease of exploitation and the critical severity, it is highly likely that attackers will begin scanning for and exploiting vulnerable instances. The vulnerability is not currently listed on KEV or EPSS, but the CVSS score of 9.6 indicates a high probability of exploitation if left unpatched. Public Proof-of-Concept (PoC) code is likely to emerge, further increasing the risk.
Exploit Status
EPSS
0.02% (6% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-52835 is to immediately upgrade the WING WordPress Migrator plugin to version 2.0.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to reduce the attack surface. Implementing strict Content Security Policy (CSP) headers can also help mitigate the risk by restricting the sources from which the browser can load resources. Web Application Firewalls (WAFs) configured to detect and block suspicious requests targeting the plugin's upload endpoints can provide an additional layer of defense. After upgrading, verify the fix by attempting to trigger the upload functionality with a crafted CSRF request – it should be blocked.
Update to version 2.0.0, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-52835 is a critical Cross-Site Request Forgery (CSRF) vulnerability in the WING WordPress Migrator plugin, allowing attackers to upload web shells and potentially gain full control of a WordPress site.
You are affected if you are using WING WordPress Migrator versions 0.0.0 through 1.2.0. Check your plugin version immediately and upgrade if necessary.
Upgrade the WING WordPress Migrator plugin to version 2.0.0 or later. If immediate upgrade isn't possible, disable the plugin temporarily.
While there's no confirmed active exploitation currently, the vulnerability's severity and ease of exploitation suggest it's likely to be targeted soon.
Refer to the ConoHa by GMO WING website and WordPress plugin repository for the latest advisory and update information regarding CVE-2025-52835.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.