CVE-2025-10057: 
WordPress Análise e mitigação de vulnerabilidades

The WP Import – Ultimate CSV XML Importer for WordPress plugin versions up to 7.27 contains a vulnerability identified as CVE-2025-10057. The vulnerability was discovered by researcher Arkadiusz Hydzik and was disclosed on September 16, 2025. This security issue affects authenticated users with Subscriber level permissions or higher (Tenable CVE, Wordfence Intel).

The vulnerability is classified as a Remote Code Execution (RCE) vulnerability that affects the WP Import – Ultimate CSV XML Importer plugin for WordPress. The issue exists in versions up to and including 7.27, allowing authenticated users with subscriber-level access or higher to execute arbitrary code on the affected systems (Tenable CVE).

The vulnerability allows authenticated attackers with subscriber-level access or higher to execute arbitrary code on the affected WordPress installations, potentially leading to complete system compromise (Tenable CVE).

The vulnerability was addressed in version 7.29 of the plugin, which was released as a security update. Site administrators are strongly advised to update to the latest version immediately (WordPress Plugin).