CVE-2025-5061highCWE-434

CVE-2025-5061: high-severity vulnerability in vjinfotech WP Import Export Lite

WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor WP Import Export Lite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
vjinfotech · WP Import Export Lite
Related CVEs — vjinfotech WP Import Export Lite

In the same product, most dangerous first.

CVE-2022-0236HIGHWP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data DisclosureEPSS 4.3%CVE-2025-6207HIGHWP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.8%CVE-2026-11397MEDIUMWP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' ParameterEPSS 0.4%CVE-2025-2839MEDIUMWP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%