CVE-2025-4190
HIGHWordPress CSV Mass Importer <1.2 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2025-4190. PoCs published by Nxploited, GadaLuBau1337, Boshe99.
AI-analyzed exploit summary This exploit targets CVE-2025-4190, an arbitrary file upload vulnerability in the WordPress CSV Mass Importer plugin (≤ 1.2). It allows authenticated admin users to upload a malicious PHP shell via a crafted ZIP file, leading to remote code execution.
Description
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Exploits (3)
This exploit targets CVE-2025-4190, an arbitrary file upload vulnerability in the WordPress CSV Mass Importer plugin (≤ 1.2). It allows authenticated admin users to upload a malicious PHP shell via a crafted ZIP file, leading to remote code execution.
This is a functional exploit for CVE-2025-4190, targeting WordPress CSV Mass Importer ≤ 1.2. It allows admin users to upload arbitrary files via a crafted ZIP payload, leading to remote code execution.
The repository contains functional exploit code for CVE-2025-4190, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H