CVE-2025-4954
📋 TL;DR
The Axle Demo Importer WordPress plugin through version 1.0.3 contains an arbitrary file upload vulnerability that allows authenticated users with author-level permissions or higher to upload malicious files like PHP scripts to the server. This affects WordPress sites using the vulnerable plugin version.
💻 Affected Systems
- Axle Demo Importer WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full server control through remote code execution, leading to data theft, site defacement, malware distribution, or complete system compromise.
Likely Case
Authenticated attackers upload web shells to establish persistent access, steal sensitive data, or use the server for malicious activities.
If Mitigated
With proper file validation and access controls, unauthorized file uploads are blocked, limiting impact to attempted attacks.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4 or later
Vendor Advisory: https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Axle Demo Importer and update to version 1.0.4 or later. 4. If update not available, deactivate and delete the plugin.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily deactivate the vulnerable plugin until patched.
wp plugin deactivate axle-demo-importer
Restrict File Uploads
linuxConfigure web server to block PHP file execution in upload directories.
Add 'deny from all' to .htaccess in wp-content/uploads/axle-demo-importer/
🧯 If You Can't Patch
- Remove author and higher role permissions from untrusted users
- Implement web application firewall rules to block suspicious file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Axle Demo Importer version. If version is 1.0.3 or earlier, system is vulnerable.Check Version:
wp plugin get axle-demo-importer --field=versionVerify Fix Applied:
Confirm plugin version is 1.0.4 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/uploads/axle-demo-importer/
- PHP file creation in upload directories
- Multiple failed upload attempts
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with file upload parameters
- Unusual outbound connections from server after uploads
SIEM Query:
source="wordpress.log" AND ("axle-demo-importer" OR "admin-ajax.php") AND ("upload" OR "file")