CVE-2025-10058 is a vulnerability in the WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress plugin caused by insufficient validation of file paths in the upload_function(). This flaw enables authenticated attackers with at least Subscriber privileges to perform arbitrary file deletion on the server. Deleting critical files like wp-config.php can lead to remote code execution. The vulnerability affects all plugin versions up to 7.27. It has a CVSS v3.1 base score of 8.1, indicating high severity. No patch or remediation guidance is currently available from the vendor.

An attacker with Subscriber-level access or higher can delete arbitrary files on the server hosting the WordPress site. This can disrupt site availability and potentially enable remote code execution if key files such as wp-config.php are deleted. The vulnerability does not directly disclose data confidentiality loss but impacts integrity and availability significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to file deletions. Avoid granting Subscriber or higher privileges to untrusted users. No official fix or temporary workaround is currently documented.