CVE-2025-10057: Smackcoders Wp Import – Ultimate Csv XML Importer For WordPress

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject the customFunction.php file with PHP code that can be accessed to trigger remote code execution.

Affected products

• Smackcoders Wp Import – Ultimate Csv XML Importer For WordPress: from 7.20, up to and including 7.28

Published 2025-09-17. Last modified 2026-09-26.