CVE-2025-4954

Axle Demo Importer <= 1.0.3 - Author+ Arbitrary File Upload

CVSS 8.8 HIGHEPSS 0.5%

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 jun 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Unknown · Axle Demo Importer

Referencias

https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8/