CVE-2025-34083
WordPress AIT CSV Import/Export Unrestricted File Upload Vulnerability
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.
INFO
Published Date :
July 9, 2025, 1:15 a.m.
Last Modified :
July 16, 2025, 4:15 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-34083
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Remove the rejected CVE entry.
- Update the system with the correct CVE details.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-34083 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-34083 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Jul. 16, 2025
Action Type Old Value New Value -
CVE Modified by [email protected]
Jul. 16, 2025
Action Type Old Value New Value Changed Description An unrestricted file upload vulnerability exists in the WordPress AIT CSV Import/Export plugin ≤ 3.0.3. The plugin exposes an upload handler at upload-handler.php that allows arbitrary file upload via a multipart/form-data POST request. This endpoint does not enforce authentication or content-type validation, enabling attackers to upload malicious PHP code directly to the server. Although the upload may produce an error related to CSV parsing, the malicious file is still saved under wp-content/uploads/ and remains executable. Notably, the plugin does not need to be active for exploitation to succeed. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849. Removed CVSS V4.0 VulnCheck: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CWE VulnCheck: CWE-20 Removed CWE VulnCheck: CWE-306 Removed CWE VulnCheck: CWE-434 Removed Reference VulnCheck: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_ait_csv_rce.rb Removed Reference VulnCheck: https://packetstorm.news/files/id/160918 Removed Reference VulnCheck: https://vulncheck.com/advisories/wordpress-ait-csv-import-export-plugin-rce Removed Reference VulnCheck: https://wpscan.com/vulnerability/36e699a4-91f2-426d-ba14-26036fbfeaea/ Removed Reference VulnCheck: https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-ait-themes-csv-import-export-arbitrary-file-upload-3-0-3/ Removed Reference VulnCheck: https://www.ait-themes.club/csv-import-export-wordpress-plugin/ Removed Reference VulnCheck: https://www.fortiguard.com/encyclopedia/ips/49754 Removed Reference VulnCheck: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ait-csv-import-export/ait-csv-importexport-303-arbitrary-file-upload -
New CVE Received by [email protected]
Jul. 09, 2025
Action Type Old Value New Value Added Description An unrestricted file upload vulnerability exists in the WordPress AIT CSV Import/Export plugin ≤ 3.0.3. The plugin exposes an upload handler at upload-handler.php that allows arbitrary file upload via a multipart/form-data POST request. This endpoint does not enforce authentication or content-type validation, enabling attackers to upload malicious PHP code directly to the server. Although the upload may produce an error related to CSV parsing, the malicious file is still saved under wp-content/uploads/ and remains executable. Notably, the plugin does not need to be active for exploitation to succeed. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-20 Added CWE CWE-306 Added CWE CWE-434 Added Reference https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_ait_csv_rce.rb Added Reference https://packetstorm.news/files/id/160918 Added Reference https://vulncheck.com/advisories/wordpress-ait-csv-import-export-plugin-rce Added Reference https://wpscan.com/vulnerability/36e699a4-91f2-426d-ba14-26036fbfeaea/ Added Reference https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-ait-themes-csv-import-export-arbitrary-file-upload-3-0-3/ Added Reference https://www.ait-themes.club/csv-import-export-wordpress-plugin/ Added Reference https://www.fortiguard.com/encyclopedia/ips/49754 Added Reference https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ait-csv-import-export/ait-csv-importexport-303-arbitrary-file-upload