Arbitrary File Upload Vulnerability in URL Image Importer Plugin for WordPress

CVE-2025-12138

What is CVE-2025-12138?

The URL Image Importer plugin for WordPress contains a vulnerability that allows authenticated users with Author-level access and above to upload arbitrary files due to insufficient file type validation. This occurs because the plugin incorrectly relies on a user-controlled Content-Type HTTP header to verify uploaded files in the 'uimptr_import_image_from_url()' function. The lack of proper validation before the file is written to the server can lead to potential remote code execution through maliciously crafted PHP files.

References