PHP Object Injection Vulnerability in WP Import – Ultimate CSV XML Importer Plugin

CVE-2025-13145

What is CVE-2025-13145?

The WP Import – Ultimate CSV XML Importer plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to improper handling of untrusted data during the CSV file import process. Specifically, the flaw exists in the import_single_post_as_csv function located in SingleImportExport.php. This vulnerability allows attackers with administrator-level access to leverage object injection to potentially exploit other vulnerabilities present in the system, such as deleting arbitrary files or executing malicious code, especially if an exploitable PHP object pollution (POP) chain is established through additional plugins or themes.

References