Arbitrary File Upload Vulnerability in Import Any XML, CSV or Excel File Plugin for WordPress
CVE-2025-10001
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 10 September 2025
What is CVE-2025-10001?
The Import Any XML, CSV or Excel File plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation in its import functionality. This issue affects all versions up to and including 3.9.3. Authenticated users with Administrator-level access can exploit this flaw to upload potentially unsafe files, such as .phar files, which may lead to unauthorized remote code execution on the affected website's server.
Affected Version(s)
Import any XML, CSV or Excel File to WordPress * <= 3.9.3