CVE-2025-10001: fallo de gravedad alta en wpallimport WP All Import – Drag & Drop Import…
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 0.6%
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
wpallimport · WP All Import – Drag & Drop Import for CSV, XML, Excel & Google SheetsCVEs relacionadas — wpallimport WP All Import – Drag & Drop Import…
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-1565HIGHImport any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File UploadEPSS 15.2%CVE-2025-12733HIGHImport any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional LogicEPSS 0.7%CVE-2026-2830MEDIUMWP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'EPSS 0.3%