CVE-2025-12894
Medium
Description
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.
SeverityMedium
CVSS5.3
Exploit probability—
ProductImport WP – Export and Import CSV and XML files to WordPress
PublishedNov 21, 2025
First seenNov 21, 2025
Weakness typeCWE-552CWE-552
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jcollings Import WP – Export and Import CSV and XML files to WordPress | v ≤ 2.14.17 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.