CVE-2025-6207
BaseFortify
Publication date: 2025-08-05
Last updated on: 2025-08-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vjinfotech | wp_import_export_lite | to 3.9.29 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the WP Import Export Lite WordPress plugin (up to version 3.9.28) where the 'wpie_tempalte_import' function lacks proper file type validation. This allows authenticated users with Subscriber-level access or higher, given permissions by an Administrator, to upload arbitrary files to the server. Because the plugin does not properly restrict the types of files that can be uploaded, attackers can potentially upload malicious files that could lead to remote code execution on the affected site. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with low-level authenticated access to upload arbitrary files to your WordPress server. This can lead to remote code execution, meaning the attacker could run malicious code on your server, potentially compromising the entire website, stealing data, defacing the site, or using the server for further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WP Import Export Lite plugin version is up to and including 3.9.28 and if the 'wpie_tempalte_import' function is accessible to authenticated users with Subscriber-level access or higher. Since the vulnerability involves arbitrary file uploads via the import template feature, monitoring for unusual file upload activity or unexpected files in the plugin's template storage directory may help detect exploitation attempts. Specific commands are not provided in the resources, but you can check the plugin version via WordPress admin or by running: `wp plugin list | grep wp-import-export-lite`. Additionally, reviewing web server logs for POST requests to AJAX actions related to 'wpie_tempalte_import' or monitoring for file uploads with MIME type 'text/plain' to the plugin's upload directories could help detect attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the WP Import Export Lite plugin to a version later than 3.9.28 where the vulnerability is fixed. If an update is not immediately available, restrict or disable the 'wpie_tempalte_import' functionality for users with Subscriber-level access or lower, and review user capabilities to ensure only trusted users have permissions to upload templates. Additionally, monitor and restrict file uploads to only allowed MIME types and implement additional file validation or scanning on the server side. Removing or disabling the vulnerable plugin until a patch is applied is also recommended. [1]