Arbitrary File Upload Vulnerability in URL Image Importer Plugin for WordPress

CVE-2025-12138

What is CVE-2025-12138?

The URL Image Importer plugin for WordPress contains a vulnerability that allows authenticated users with Author-level access and above to upload arbitrary files due to insufficient file type validation. This occurs because the plugin incorrectly relies on a user-controlled Content-Type HTTP header to verify uploaded files in the 'uimptr_import_image_from_url()' function. The lack of proper validation before the file is written to the server can lead to potential remote code execution through maliciously crafted PHP files.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References