CVE-2025-13145 is a deserialization vulnerability classified under CWE-502 affecting the WP Import – Ultimate CSV XML Importer plugin for WordPress. The flaw arises from the import_single_post_as_csv function in SingleImportExport.php, which deserializes data from CSV imports without proper validation or sanitization. This allows an authenticated attacker with administrator privileges to inject crafted PHP objects. The vulnerability is a PHP Object Injection (POI) issue, which can lead to remote code execution, arbitrary file deletion, or data disclosure if a suitable POP chain is present in the environment. The attack vector requires no user interaction but does require high privileges, limiting exposure to trusted users with admin access. The CVSS v3.1 score of 7.2 reflects high impact on confidentiality, integrity, and availability, with network attack vector and low attack complexity. No patches are currently linked, and no exploits are known in the wild, but the risk is significant due to the potential for full system compromise. The vulnerability highlights the dangers of insecure deserialization in WordPress plugins that handle file imports, especially when combined with complex plugin/theme ecosystems that may provide POP gadgets.

For European organizations, this vulnerability poses a serious risk to WordPress-based websites, particularly those using the WP Import plugin for content or data migration. Successful exploitation can lead to full site compromise, including unauthorized data access, defacement, or service disruption. This can affect e-commerce platforms, corporate websites, and government portals relying on WordPress, potentially leading to data breaches, loss of customer trust, regulatory fines under GDPR, and operational downtime. The requirement for administrator-level access somewhat limits the attack surface but insider threats or compromised admin credentials could enable exploitation. Organizations with complex WordPress environments and multiple plugins/themes are at higher risk due to the possibility of POP chains enabling code execution. The lack of known exploits in the wild reduces immediate threat but does not eliminate future risk, especially as attackers often target popular CMS platforms in Europe.

1. Immediately restrict administrator-level access to trusted personnel and enforce strong authentication mechanisms such as MFA. 2. Audit all installed plugins and themes for known POP chains or unsafe deserialization patterns to reduce exploitation vectors. 3. Disable or restrict CSV import functionality if not essential, or implement strict input validation and sanitization on imported files. 4. Monitor WordPress logs for unusual import activity or administrator actions. 5. Apply vendor patches promptly once released; in the meantime, consider temporary workarounds such as disabling the vulnerable import function or isolating the WordPress environment. 6. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious deserialization payloads. 7. Regularly back up WordPress sites and test restoration procedures to minimize impact from potential exploitation. 8. Educate administrators about the risks of importing untrusted CSV files and the importance of secure plugin management.