CVE-2025-10058

Executive Summary

CVE-2025-10058 is a critical arbitrary file deletion vulnerability in the WordPress plugin WP Import – Ultimate CSV XML Importer (versions up to and including 7.27). The flaw resides in the upload_function() function, which fails to properly validate file paths. An authenticated attacker with Subscriber-level access or higher can exploit this to delete arbitrary files on the server. Deleting critical files like wp-config.php can lead to complete site takeover and remote code execution. The vulnerability is currently unpatched, and no public proof-of-concept or exploit code has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed this plugin from the repository are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a component of the WordPress ecosystem. Administrators should verify the plugin version and consider disabling it until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high integrity and availability impact, combined with low privileges required, make this a severe threat. An attacker can delete arbitrary files, potentially causing denial of service or enabling further compromise.

Deep Dive & Mechanics

The vulnerability exists in the upload_function() function of the WP Import plugin. This function is responsible for handling file uploads during the import process. The flaw is due to insufficient validation of the file path provided by the user. Specifically, the function does not properly sanitize or restrict the path, allowing path traversal sequences (e.g., ../) to escape the intended upload directory.

An authenticated attacker can craft a request to the upload endpoint, specifying a malicious file path that points to a critical system file. For example, by setting the path to ../../wp-config.php, the attacker can delete the WordPress configuration file. This action can break the site's database connection, leading to a denial of service, or allow the attacker to reinstall WordPress and gain administrative access.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The attack vector is network-based, requiring only Subscriber-level authentication, which is easily obtainable in many WordPress installations.

Vulnerable vs. Patched Code

Since no official patch has been released, the vulnerable code is present in all versions up to 7.27. The following is a hypothetical representation of the vulnerable function and a potential fix.

Vulnerable Code (PHP):

function upload_function() {
    $file_path = $_POST['file_path'];
    // Insufficient validation - allows path traversal
    if (file_exists($file_path)) {
        unlink($file_path);
    }
}

Patched Code (Hypothetical):

function upload_function() {
    $upload_dir = wp_upload_dir();
    $base_dir = $upload_dir['basedir'] . '/wp-import/';
    $file_path = realpath($base_dir . basename($_POST['file_path']));
    // Ensure the resolved path is within the allowed directory
    if (strpos($file_path, $base_dir) === 0 && file_exists($file_path)) {
        unlink($file_path);
    }
}

The patched version uses realpath() to resolve the path and then checks that it starts with the allowed base directory, preventing traversal outside the intended folder.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress installation with the WP Import plugin (version <= 7.27) active.
• An authenticated user account with at least Subscriber role.

Exploitation Steps:

1. Log in to WordPress with the subscriber account.
2. Identify the upload endpoint, typically /wp-admin/admin-ajax.php?action=wp_import_upload.
3. Craft a POST request to delete a critical file. For example, to delete wp-config.php:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [valid session cookie]
   
   action=wp_import_upload&file_path=../../wp-config.php
   

4. Verify deletion by attempting to access the site. If wp-config.php is deleted, the site will show a database connection error.
5. To achieve remote code execution, delete wp-config.php and then reinstall WordPress with a new admin account, or delete other critical files like .htaccess to weaken security.

Note: No public exploit code is available, so this is a manual process.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual file deletion requests to the admin-ajax.php endpoint.
• Look for path traversal patterns (e.g., ../) in POST parameters.
• Alert on deletion of critical files like wp-config.php, .htaccess, or index.php.

Prevention:

• Disable the WP Import plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Restrict file permissions so that the web server cannot delete critical files.
• Use file integrity monitoring (FIM) to detect unauthorized deletions.

Indicators of Compromise (IOCs)

• File Paths: wp-config.php, .htaccess, index.php, wp-settings.php
• HTTP Requests: POST requests to /wp-admin/admin-ajax.php with action=wp_import_upload and file_path containing ../
• Log Entries: PHP error logs showing unlink() failures or file not found errors for critical files.
• System State: Sudden site downtime with database connection errors.

Detection Engineering

YARA Rule

rule CVE_2025_10058_WordPress_WP_Import_File_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2025-10058 in WP Import plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10058"
    strings:
        $action = "wp_import_upload"
        $path_traversal = /\.\.\/|\.\.\\/
        $file_param = "file_path"
    condition:
        $action and $path_traversal and $file_param
}

Sigma Rule

title: CVE-2025-10058 - WP Import Plugin File Deletion Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in WP Import plugin upload function
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wp_import_upload'
        cs-uri-query|contains: 'file_path='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10058 WP Import File Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_import_upload"; http_client_body; content:"file_path"; http_client_body; pcre:"/\.\.\//Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WP Import – Ultimate CSV XML Importer plugin until an official patch is released.
2. Workaround: If the plugin is essential, restrict access to the upload functionality by modifying the plugin code to validate file paths (as shown in the patched code example).
3. File Permissions: Ensure that critical WordPress files (e.g., wp-config.php) are not writable by the web server user. Use chmod 444 or 400 for these files.
4. Web Application Firewall: Deploy WAF rules to block requests containing path traversal sequences (../) in POST parameters.
5. Monitoring: Implement file integrity monitoring (FIM) to alert on deletion of critical files.
6. User Access Control: Review and minimize the number of users with Subscriber-level access or higher. Consider using a security plugin to enforce strong authentication.

Valters IT
Securing Digital Frontiers