CVE-2025-12894 MEDIUM

CVE-2025-12894: Import WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure

Vendor Jcollings
Product Import WP – Export and Import CSV and XML files to WordPress
Weakness CWE-552 · Files accessible externally
Published November 21, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.

Explanation of Vulnerability in Simple Terms

02Summary

The Import WP plugin for WordPress versions 2.14.17 and earlier contains a file access vulnerability that allows unauthenticated attackers to read sensitive files from the server. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 2.14.17 to remediate this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive files from the server without authentication.

Potential impact on your site

04Site Impact

Attackers can access sensitive configuration files, database credentials, or other private data stored on your server.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 21, 2025 CVE published
April 8, 2026 Record updated