CVE-2025-13066

Name of the Vulnerable Software and Affected Versions Demo Importer Plus plugin for WordPress versions up to and including 2.0.6

Description The Demo Importer Plus plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when processing WXR files. This allows attackers to bypass sanitization by using double extension files, potentially leading to remote code execution. The issue affects authenticated attackers with author-level access or higher.

Recommendations Versions prior to and including 2.0.6 should have file upload access restricted. Monitor file uploads for suspicious activity.