CVE-2025-4954

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server

Score

CVSS 3.1 8.8 High

Status

Analyzed - contact@wpscan.com

Published

2025-06-10

Last modified

2025-06-11

Weaknesses

CWE-434

Affected products

• Axle Demo Importer (Axlethemes)
• Axle Demo Importer (Unknown)

References

• https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8/