Arbitrary File Read Vulnerability in Import WP Plugin for WordPress

CVE-2025-12137

What is CVE-2025-12137?

The Import WP – Export and Import CSV and XML files to WordPress plugin is susceptible to an Arbitrary File Read vulnerability due to improper validation of file paths in its REST API endpoint. This flaw arises in the 'attach_file()' function, where the 'file_local' actions permit authenticated users, specifically those with administrator-level access, to access and read files from the server's filesystem. The exploitation of this vulnerability could lead to exposure of sensitive configuration and system files, posing significant security risks to affected installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References