CVE-2025-4190: CSV Mass Importer <= 1.2 - Admin+ Arbitrary File Upload

Description

The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Classification

CVE ID: CVE-2025-4190

Problem Types

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Vendor: Unknown

Product: CSV Mass Importer

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 15.93% (scored less or equal to compared to others)

EPSS Date: 2025-06-04 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4190
https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027/

Timeline