CVE-2025-10057

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject the customFunction.php file with PHP code that can be accessed to trigger remote code execution.

• CWE-94

• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.25/importExtensions/ImportHelpers.php#L585
• https://plugins.trac.wordpress.org/changeset/3360428/wp-ultimate-csv-importer/trunk/importExtensions/ImportHelpers.php
• https://plugins.trac.wordpress.org/changeset/3360428/wp-ultimate-csv-importer/trunk/uploadModules/DesktopUpload.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/925af22b-a728-496e-a63a-5966347ebe6c?source=cve

Published

Sep 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10050The Developer Loggers for Simple History plugin for WordPres…6.6
• CVE-2025-10051The Demo Import Kit plugin for WordPress is vulnerable to ar…7.2
• CVE-2025-10053The TableGen – Data Table Generator plugin for WordPress is …4.4
• CVE-2025-10054The ELEX WordPress HelpDesk & Customer Ticketing System plug…4.3
• CVE-2025-10055The Time Sheets plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2025-10056The Task Scheduler plugin for WordPress is vulnerable to Ser…4.4
• CVE-2025-10058The WP Import – Ultimate CSV XML Importer for WordPress plug…8.1
• CVE-2025-10059An improper setting of the lsid field on any sharded query c…6.5
• CVE-2025-1006Use after free in Network in Google Chrome prior to 133.0.69…8.8
• CVE-2025-10060MongoDB Server may allow upsert operations retried within a …7.5
• CVE-2025-10061An authorized user can cause a crash in the MongoDB Server t…6.5
• CVE-2025-10062A vulnerability was determined in itsourcecode Student Infor…9.8