CVE-2025-12733

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-127343.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 th CVE-2025-127359.8The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined CVE-2025-127366.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.CVE-2025-127378.4The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a mal CVE-2025-127381.3Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has CVE-2025-127397.3An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-sup CVE-2025-12747.8A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may le CVE-2025-127407.7A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to exe CVE-2025-127417.7A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execut CVE-2025-127427.5A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver paramet CVE-2025-127436.0The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a CVE-2025-127448.8A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input an