CVE-2025-4954

{"id": "CVE-2025-4954", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-06-10T06:15:22.403", "references": [{"url": "https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8/", "tags": ["Third Party Advisory", "Exploit"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server"}, {"lang": "es", "value": "El complemento Axle Demo Importer de WordPress hasta la versi\u00f3n 1.0.3 no valida los archivos que se cargar\u00e1n, lo que podr\u00eda permitir que usuarios autenticados (autor y superiores) carguen archivos arbitrarios como PHP en el servidor."}], "lastModified": "2025-07-02T16:11:11.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axlethemes:axle_demo_importer:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "08BD3254-4E62-4EA5-8BC8-B5888870DFB8", "versionEndIncluding": "1.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}