CVE-2025-10051 is a vulnerability in the Demo Import Kit WordPress plugin by themeinwp, affecting all versions up to and including 1.1.0. The issue arises from the lack of proper file type validation in the import functionality, permitting authenticated users with Administrator privileges or higher to upload arbitrary files. This can lead to remote code execution on the server hosting the WordPress site. The vulnerability is identified as CWE-434 and has a CVSS 3.1 score of 7.2, indicating high impact on confidentiality, integrity, and availability.

An attacker with Administrator-level access can exploit this vulnerability to upload malicious files to the server, potentially resulting in remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Since the vulnerability requires high privileges, exploitation is limited to users with elevated access, but the consequences are severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious file uploads related to the Demo Import Kit plugin. Consider disabling or removing the plugin if not essential.