CVE-2025-10057 – WP Import – Ultimate CSV XML Importer for WordPress 7.20 – 7.28 – Authenticated (Subscriber+) Remote Code Execution via Code Injection

CVE ID : CVE-2025-10057

Published : Sept. 17, 2025, 6:15 a.m. | 43 minutes ago

Description : The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject the customFunction.php file with PHP code that can be accessed to trigger remote code execution.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…