Arbitrary File Deletion Vulnerability in WP Import Plugin for WordPress

CVE-2025-10058

What is CVE-2025-10058?

The WP Import – Ultimate CSV XML Importer for WordPress is susceptible to arbitrary file deletion due to inadequate validation of file paths in the upload_function(). Authenticated attackers with a minimum of Subscriber-level access can exploit this vulnerability to delete arbitrary files from the server. This could potentially enable remote code execution, especially if critical files like 'wp-config.php' are targeted. Users should ensure that they update to the latest version immediately to mitigate this risk.

References