CVE-2025-14478
BaseFortify
Publication date: 2026-01-17
Last updated on: 2026-01-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | demo_importer_plus | to 2.0.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an XML External Entity Injection (XXE) in the Demo Importer Plus WordPress plugin (versions up to 2.0.9) that occurs via the SVG file upload functionality. Authenticated users with Author-level access or higher can exploit this vulnerability to execute code on the server if the site is running PHP versions older than 8.0. The issue arises because the plugin parses SVG files insecurely, allowing malicious XML entities to be processed, which can lead to code execution. [4]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with Author-level access or higher to execute arbitrary code on the server hosting the WordPress site. This can lead to full compromise of the site, including unauthorized access, data theft, defacement, or further attacks on the hosting environment. The vulnerability specifically affects sites running PHP versions older than 8.0 and using vulnerable versions of the Demo Importer Plus plugin.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can focus on identifying uploads of SVG files via the Demo Importer Plus plugin on WordPress sites running PHP versions older than 8.0, especially if the plugin version is 2.0.9 or earlier. Since the vulnerability involves XML External Entity (XXE) injection via SVG uploads, monitoring for unusual SVG file uploads or suspicious XML parsing activity is key. Specific commands are not provided in the resources, but you can check plugin version and PHP version with commands like `wp plugin list` (to check Demo Importer Plus version) and `php -v` (to check PHP version). Additionally, monitoring web server logs for POST requests uploading SVG files to the plugin's upload endpoints may help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading the Demo Importer Plus plugin to version 2.0.10 or later, where the SVG parsing method was updated to securely use PHP's DOMDocument with external entity loading and entity substitution disabled, preventing XXE attacks. Also, ensure your PHP version is 8.0 or newer, as the vulnerability only affects older PHP versions. If upgrading is not immediately possible, restrict SVG file uploads or disable the plugin's SVG upload functionality to reduce risk. [1, 4]