We recently received notice of a vulnerability in WP All Import. The vulnerability notice was received on a Friday, and then we released the patched versions on the following Monday. We recommend updating to the latest versions as soon as possible.
What’s been released and what does it fix?
WP All Import Pro 4.11.6 and WP All Import Free 3.9.4
- CVE-2025-10001: Authenticated (Admin+) Limited Unsafe File Upload
Detailed Overview of Vulnerabilities
CVE-2025-10001: Authenticated (Admin+) Limited Unsafe File Upload
Someone granted admin access sufficient to use WP All Import could import a ZIP archive containing a valid file plus one or more executable files. It could then be possible to load any executable files via URL to trigger their payload.
Questions & Answers
Has this vulnerability been exploited?
To the best of our knowledge, this vulnerability has never been exploited maliciously. No user has reported a site being compromised due to this issue. However, it’s common for malicious actors to begin to scan for sites running older versions of plugins that are susceptible to the vulnerabilities. While the nature of these vulnerabilities makes them unsuitable for mass exploitation, we strongly advise you to update as soon as possible.
What if my site was already hacked? Should I be scared?
This vulnerability has existed in WP All Import for a very long time. We've never heard a single report of it being exploited maliciously. It was brought to our attention by a security researcher, not a malicious hacker. If your site is or was recently hacked, it is highly unlikely that this vulnerability was the cause. If you believe that you were hacked as a result of this vulnerability, feel free to get in touch and we’ll see if we can determine if this CVE was involved.
How do I install the update?
- Back up your site. Always back up before making significant changes or updating plugins.
- Update from your WP Admin Dashboard. Visit Plugins > Installed Plugins, locate WP All Import / WP All Export, and click Update (if available).
- Manual update (if needed):
- Deactivate and delete the old plugin version from your WordPress dashboard. (Don’t worry—your imports/exports, templates, and settings remain in your database.)
- Download the newest version from your Customer Portal (Pro) or from WordPress.org (Free).
- Install and activate the new version.
Special thanks to Nguyen Quang Truong (Roll) for reporting the vulnerability via WordFence.
