CVE-2025-4190

Published: May 17, 2025Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Affected (1)

Products: Aleapp: Csv Mass Importer

Aleapp

1 product

Csv Mass Importer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Aleapp Csv Mass Importer	Up to 1.2

References (2)

https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.