CVE-2025-4190 CSV Mass Importer <= 1.2 - Admin+ Arbitrary File Upload
Administrators can upload arbitrary files to the server due to insufficient validation in the CSV Mass Importer plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4190?
CVE-2025-4190 is a high-severity vulnerability in Unknown CSV Mass Importer, published on 17 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Which versions are affected by CVE-2025-4190?
It affects 1 product.
Products include Aleapp Csv Mass Importer.
How do I fix CVE-2025-4190?
No fix has been published for CVE-2025-4190 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4190 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4190 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-7rm6-cjw9-cf8v.