External risk intelligence

WordPress WP移行専用プラグイン Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-11170

The vulnerability affects a WordPress plugin, which is software designed to extend the functionality of web-facing applications. WordPress sites are frequently deployed as public-facing web services, making the plugins installed within them commonly reachable via the internet.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the WP移行専用プラグイン for CPI WordPress plugin could allow unauthenticated attackers to upload arbitrary files, potentially leading to the execution of malicious code on affected servers.

Unauthenticated file uploads create server risks.
Matters for any public-facing WordPress sites.
Confirm plugin relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can upload malicious files to a WordPress server through a plugin that lacks proper file type validation. This could allow an unauthenticated attacker to execute code remotely on the server.

Unauthenticated access to the website.
Uploading arbitrary files via the import function.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthenticated attackers to upload arbitrary files to the affected website's server, potentially leading to remote code execution.

Arbitrary file uploads to server.
Unauthenticated attackers can upload files.
Remote code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the WP移行専用プラグイン for CPI could allow unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. Identifying affected WordPress sites and confirming exposure is the immediate priority, followed by owner engagement to plan remediation.

Plugin and site owners should own the issue.
Verify plugin presence and server exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP移行専用プラグイン for CPI?

It is a WordPress plugin designed to assist users in migrating data or content specifically for the CPI hosting environment. Plugins like this function as extensions to the core WordPress platform, often introducing specialized utilities or administrative features to manage site configurations and file imports.

What does CWE-434 mean regarding CVE-2025-11170?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this CVE, the plugin fails to check or restrict the format of files uploaded through its import function. Because the software does not verify if a file is safe, it may inadvertently allow an attacker to upload executable scripts that the server then processes.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a crafted request to the vulnerable import function within the plugin. Because the code lacks validation logic, it accepts files regardless of their type. Simply visiting the site or interacting with standard, non-import features of the plugin does not trigger this security flaw.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a significant concern because the plugin is designed for WordPress, a platform typically deployed as an internet-facing web service. Because these services are often reachable by anyone on the public web, the lack of input validation makes the plugin a potential entry point for external attackers.

What steps should I take if I use this plugin?

First, verify if the plugin is installed and active on your WordPress instance. If it is present, check the version to see if it is 1.0.2 or older. Since the vulnerability allows unauthenticated access, prioritize disabling or removing the plugin until you can confirm a secure version is available or implement alternative migration methods.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.