CVE-2025-14478 identifies an XXE vulnerability in the Demo Importer Plus plugin for WordPress, affecting all versions up to 2.0.9. The issue arises from improper restriction of XML external entity references when processing SVG file uploads. Exploitation requires authenticated access at the Author level or above and is limited to environments running PHP versions prior to 8.0. Successful exploitation can lead to remote code execution. The vulnerability is tracked under CWE-611 and has a CVSS v3.1 base score of 7.5 (high). No patch or remediation details are currently available from the vendor.

This vulnerability allows authenticated users with Author-level privileges or higher to execute arbitrary code on affected WordPress sites running PHP versions older than 8.0. The impact is limited to such configurations and does not affect sites running PHP 8.0 or later. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting Author-level user capabilities related to SVG uploads or upgrading PHP to version 8.0 or higher, where the vulnerability does not apply. Monitor vendor communications for updates on patches or official mitigations.