CVE-2025-10051

HIGH 7.2

Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CWE	CWE-434
Vendor	themeinwp
Product	demo import kit
Published	Oct 15, 2025
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for themeinwp demo import kit

Be the first to know when new high vulnerabilities affecting themeinwp demo import kit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

themeinwp / Demo Import Kit

0 ≤ 1.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/465f2fd1-9eb3-43ca-8acc-74acf6bcde1a?source=cve wordpress.org: https://wordpress.org/plugins/demo-import-kit/

Credits

Le Cong Danh