CVE-2025-11170 is a critical vulnerability in the WP移行専用プラグイン for CPI WordPress plugin, specifically in the Cpiwm_Import_Controller::import function. The plugin fails to validate uploaded file types, allowing unauthenticated attackers to upload arbitrary files to the server. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to and including 1.0.2. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server hosting the vulnerable plugin, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its underlying server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's upload functionality and consider disabling or removing the plugin if not essential. Monitor for updates from the vendor and apply patches promptly once available.