CVE-2025-11170criticalCWE-434

CVE-2025-11170: critical vulnerability in kddiwebcommunications WP移行専用プラグイン for CPI

WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor WP移行専用プラグイン for CPI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.8%
The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
kddiwebcommunications · WP移行専用プラグイン for CPI