CVE-2025-12138 – The URL Image Importer WordPress plugin allows ... (How to Fix)

Q: What is the severity of CVE-2025-12138?

CVE-2025-12138 has a CVSS score of 8.8 (HIGH). The URL Image Importer WordPress plugin allows authenticated attackers with Author-level access or higher to upload arbitrary files, including PHP files, due to improper validation of user-controlled Content-Type headers. This vulnerability affects all versions up to 1.0.6 and can lead to remote code execution on vulnerable WordPress sites.

📋 TL;DR

The URL Image Importer WordPress plugin allows authenticated attackers with Author-level access or higher to upload arbitrary files, including PHP files, due to improper validation of user-controlled Content-Type headers. This vulnerability affects all versions up to 1.0.6 and can lead to remote code execution on vulnerable WordPress sites.

💻 Affected Systems

Products:

WordPress URL Image Importer plugin

Versions: All versions up to and including 1.0.6

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires plugin to be installed and active. Attackers need Author-level WordPress access or higher.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete server compromise, data theft, defacement, or malware distribution.

🟠

Likely Case

Unauthorized file upload leading to webshell installation, backdoor persistence, or limited code execution.

🟢

If Mitigated

File upload attempts logged and blocked, with no successful exploitation.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.0.7 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395852%40url-image-importer&new=3395852%40url-image-importer&sfp_email=&sfph_mail=#file9

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find URL Image Importer plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 1.0.7+ from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable plugin

all

Temporarily deactivate the vulnerable plugin until patched.

wp plugin deactivate url-image-importer

Restrict file uploads

all

Use web application firewall to block suspicious file uploads to plugin endpoints.

🧯 If You Can't Patch

Remove Author-level access from untrusted users
Implement file integrity monitoring on upload directories

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin panel under Plugins > Installed Plugins.

Check Version:

wp plugin get url-image-importer --field=version

Verify Fix Applied:

Confirm plugin version is 1.0.7 or higher after update.

📡 Detection & Monitoring

Log Indicators:

Unusual file uploads to /wp-content/plugins/url-image-importer/
POST requests to plugin endpoints with non-image Content-Type headers
Unauthorized PHP file creation in upload directories

Network Indicators:

HTTP requests to plugin upload endpoints with malicious file payloads

SIEM Query:

source="wordpress.log" AND ("uimptr_import_image_from_url" OR "url-image-importer") AND ("POST" OR "upload")

📊 Metadata

CVE ID: CVE-2025-12138

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

EPSS Score: 0.3% exploit probability (53.2th percentile)

Published: November 21, 2025

Last Updated: November 21, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-12138, you might also want to check these: