CVE-2025-1913 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2025-1913?

CVE-2025-1913 has a CVSS score of 7.2 (HIGH). This vulnerability allows authenticated WordPress administrators to inject PHP objects via deserialization of untrusted input in the Product Import Export for WooCommerce plugin. The impact depends on whether other plugins/themes with POP chains are installed. Only WordPress sites using vulnerable versions of this specific plugin are affected.

📋 TL;DR

This vulnerability allows authenticated WordPress administrators to inject PHP objects via deserialization of untrusted input in the Product Import Export for WooCommerce plugin. The impact depends on whether other plugins/themes with POP chains are installed. Only WordPress sites using vulnerable versions of this specific plugin are affected.

💻 Affected Systems

Products:

Product Import Export for WooCommerce - Import Export Product CSV Suite

Versions: All versions up to and including 2.5.0

Operating Systems: All platforms running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with WooCommerce and the vulnerable plugin installed. Administrator access is required for exploitation.

📦 What is this software?

Product Import Export For Woocommerce by Webtoffee

View all CVEs affecting Product Import Export For Woocommerce →

⚠️ Risk & Real-World Impact

🔴

Worst Case

If combined with a POP chain from another plugin/theme, attackers could achieve remote code execution, file deletion, or data exfiltration.

🟠

Likely Case

Limited impact since no POP chain exists in the vulnerable plugin itself; exploitation requires specific additional vulnerable components.

🟢

If Mitigated

With proper access controls limiting administrator accounts, the attack surface is minimal.

🌐 Internet-Facing: MEDIUM - WordPress sites are typically internet-facing, but exploitation requires administrator credentials.

🏢 Internal Only: LOW - Same credential requirements apply internally.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires administrator credentials and depends on presence of POP chains in other installed components.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 2.5.0

Vendor Advisory: https://wordpress.org/plugins/product-import-export-for-woo/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Product Import Export for WooCommerce'. 4. Click 'Update Now' if available, or manually update to latest version. 5. Verify plugin version is above 2.5.0.

🔧 Temporary Workarounds

Remove vulnerable plugin

all

Temporarily disable or remove the plugin until patched

Restrict administrator accounts

all

Minimize number of administrator accounts and implement strong authentication

🧯 If You Can't Patch

Implement strict access controls for administrator accounts
Monitor for suspicious administrator activity and plugin usage

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Product Import Export for WooCommerce. If version is 2.5.0 or lower, you are vulnerable.

Check Version:

wp plugin list --name='product-import-export-for-woo' --field=version

Verify Fix Applied:

Verify plugin version is above 2.5.0 in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual administrator activity, especially related to product import/export functions
POST requests to /wp-admin/admin-ajax.php with 'form_data' parameter containing serialized data

Network Indicators:

HTTP requests to WordPress admin-ajax endpoints with serialized PHP objects in parameters

SIEM Query:

source="wordpress.log" AND ("admin-ajax.php" AND "form_data" AND ("O:" OR "C:" OR "a:" OR "s:"))

📊 Metadata

CVE ID: CVE-2025-1913

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

EPSS Score: 1.79% exploit probability (82.4th percentile)

Published: March 26, 2025

Last Updated: December 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-1913, you might also want to check these: