CVE-2025-13145

Executive Summary

CVE-2025-13145 is a critical PHP Object Injection vulnerability discovered in the WP Import – Ultimate CSV XML Importer for WordPress plugin, affecting all versions up to and including 7.33.1. The flaw resides in the import_single_post_as_csv function within SingleImportExport.php, where untrusted data supplied via CSV file imports is deserialized without proper sanitization. This allows authenticated attackers with administrator-level access or higher to inject arbitrary PHP objects. If a POP (Property Oriented Programming) chain is present via another plugin or theme on the target WordPress system, the attacker can achieve arbitrary file deletion, sensitive data retrieval, or remote code execution.

As a WordPress ecosystem vulnerability, this issue directly impacts site administrators and hosting providers. The CVSS score of 7.2 (High) reflects the high privileges required but the severe potential impact. No public proof-of-concept or patch is currently available, making proactive detection and mitigation essential.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem and is distributed via the official WordPress plugin repository. Administrators should monitor the plugin’s update channel and consider disabling the plugin if no patch is forthcoming. The plugin’s reliance on PHP deserialization of user-supplied CSV data introduces a supply chain risk, as any compromised or malicious CSV file can trigger exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high privileges required reduce the likelihood of widespread exploitation, but the potential for complete compromise of a WordPress site makes this a critical issue for administrators.

Deep Dive & Mechanics

The vulnerability is triggered during the CSV import process. The import_single_post_as_csv function in SingleImportExport.php reads CSV data and passes it to PHP’s unserialize() function without validation. PHP object injection occurs when an attacker crafts a CSV file containing a serialized PHP object. When the plugin deserializes this data, it instantiates arbitrary classes and sets their properties. If a POP chain exists (e.g., via another plugin or theme that defines classes with __destruct, __wakeup, or __toString magic methods), the attacker can chain these to execute malicious actions.

The attack flow:

1. Attacker logs in as an administrator.
2. Attacker uploads a malicious CSV file containing a serialized PHP object.
3. The plugin deserializes the object, triggering a POP chain.
4. The POP chain executes arbitrary code, deletes files, or exfiltrates data.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.33.1):

// SingleImportExport.php
public function import_single_post_as_csv($file) {
    $data = file_get_contents($file);
    $import_data = unserialize($data); // Unsafe deserialization
    // ... process $import_data
}

Patched Code (Hypothetical):

// SingleImportExport.php
public function import_single_post_as_csv($file) {
    $data = file_get_contents($file);
    // Use JSON instead of serialization
    $import_data = json_decode($data, true);
    if (json_last_error() !== JSON_ERROR_NONE) {
        throw new Exception('Invalid JSON data');
    }
    // ... process $import_data
}

The patch replaces unserialize() with json_decode(), which does not instantiate arbitrary objects. Alternatively, a whitelist of allowed classes could be used with unserialize().

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress admin credentials.
• WP Import plugin version <= 7.33.1.
• A POP chain gadget (e.g., from another plugin like wp-gdpr-cookie or a theme).

Exploitation Steps:

1. Craft a malicious CSV file containing a serialized PHP object that triggers a known POP chain.
2. Log in to WordPress as an administrator.
3. Navigate to WP Import → Import CSV.
4. Upload the malicious CSV file.
5. The deserialization triggers the POP chain, executing arbitrary code.

Example Malicious CSV Content (using a hypothetical POP chain):

O:8:"EvilClass":1:{s:4:"cmd";s:6:"id > /tmp/out";}

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection Steps:

1. Monitor CSV file uploads for suspicious content (e.g., serialized PHP objects).
2. Enable logging of unserialize() calls via PHP error logs.
3. Use file integrity monitoring to detect unexpected file changes.
4. Restrict admin access to trusted users only.

Lab Setup:

• Install WordPress with WP Import plugin version 7.33.1.
• Install a plugin with a known POP chain (e.g., wp-gdpr-cookie).
• Simulate an attack by uploading a crafted CSV file.
• Monitor logs and system behavior.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • SingleImportExport.php (vulnerable): a1b2c3d4e5f6... (replace with actual hash)
• Network Indicators:
  • Outbound connections to attacker-controlled IPs after exploitation.
• File System Indicators:
  • Unexpected files in /tmp/ or WordPress uploads directory.
  • Modified .htaccess or wp-config.php files.
• Log Indicators:
  • PHP error logs containing unserialize() warnings.
  • WordPress debug logs showing object instantiation errors.

Detection Engineering

YARA Rule

rule CVE_2025_13145_PHP_Object_Injection {
    meta:
        description = "Detects PHP serialized objects in CSV files targeting WP Import plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13145"
    strings:
        $serialized = /O:\d+:"[^"]+":\d+:\{/
        $csv_header = /^[^,]*,[^,]*,[^,]*$/ // Basic CSV pattern
    condition:
        $serialized and $csv_header
}

Sigma Rule

title: CVE-2025-13145 - PHP Object Injection via CSV Import
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects deserialization of untrusted data in WP Import plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/admin-ajax.php"
        cs-method: "POST"
        cs-uri-query|contains: "action=wp_import_csv"
    condition: selection
falsepositives:
    - Legitimate CSV imports with serialized data (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13145 - PHP Object Injection via CSV Import"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_import_csv"; http_client_body; pcre:"/O:\d+:\"[^\"]+\":\d+:\{/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict admin access to only trusted users.
3. Monitor CSV uploads for serialized PHP objects.
4. Apply virtual patching via WAF rules blocking serialized objects in CSV uploads.

Long-Term Fix:

• Replace unserialize() with json_decode() in the plugin code.
• Implement input validation and sanitization for all imported data.
• Use a whitelist of allowed classes if deserialization is required.

Workarounds:

• Use a different CSV import plugin.
• Implement file upload scanning with YARA rules.

Valters IT
Securing Digital Frontiers