CVE-2025-12894
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Nov 21, 2025
CISA due date
—
The record
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-552
- CVE-2026-119201 Nuxt is an open-source web development framework for Vue.js. CWE-552
- CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control… CWE-552
- CVE-2026-65210 This issue may allow an authenticated IPMI Administrator to read arbitrary files from the… CWE-552
- CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-552
- CVE-2026-114400 Trudesk through 1.2.11 contains a missing authentication vulnerability that allows… CWE-552
- CVE-2026-87348 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… CWE-552
- CVE-2026-85840 Files or directories accessible to external parties in Windows Event Viewer allows an… CWE-552