The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8/ | Third Party Advisory Exploit |
Configurations
History
02 Jul 2025, 16:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8/ - Third Party Advisory, Exploit | |
| First Time |
Axlethemes
Axlethemes axle Demo Importer |
|
| CWE | CWE-434 | |
| CPE | cpe:2.3:a:axlethemes:axle_demo_importer:*:*:*:*:*:wordpress:*:* |
10 Jun 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-10 06:15
Updated : 2025-07-02 16:11
NVD link : CVE-2025-4954
Mitre link : CVE-2025-4954
JSON object : View
Products Affected
axlethemes
- axle_demo_importer
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type