Arbitrary File Upload Vulnerability in Demo Import Kit Plugin for WordPress

CVE-2025-10051

What is CVE-2025-10051?

The Demo Import Kit plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation in its import functionality. This flaw affects all versions up to and including 1.1.0, allowing authenticated attackers, specifically those with Administrator-level access, to upload arbitrary files to the server hosting the affected site. Such unauthorized uploads could facilitate remote code execution, posing significant risks to the website’s security.

References