CVE-2025-12733 Code injection in WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
Authenticated administrators can execute arbitrary PHP code via crafted import templates due to unsafe eval usage in WP All Import.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12733?
CVE-2025-12733 is a high-severity code injection vulnerability in wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets, published on 13 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.
Weakness: CWE-94
Which versions are affected by CVE-2025-12733?
How do I fix CVE-2025-12733?
No fix has been published for CVE-2025-12733 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-12733 being exploited?
There is no known exploitation of CVE-2025-12733 in the wild and no public exploit code.
Sources
Also known as GHSA-4q3g-58h7-p7pq.