Remote Code Execution Vulnerability in WP Import – Ultimate CSV XML Importer for WordPress
CVE-2025-10057
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2025
What is CVE-2025-10057?
The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to Remote Code Execution due to an insecure function, write_to_customfile(). This function allows authenticated users with Subscriber-level access and above to write unfiltered PHP code to a file. By injecting malicious PHP code into the customFunction.php file, attackers can trigger Remote Code Execution, potentially compromising the entire WordPress site.
Affected Version(s)
WP Import – Ultimate CSV XML Importer for WordPress 7.20 <= 7.28