CVE-2025-4954 — Axle Demo Importer <= 1.0.3 - Author+ Arbitrary File Upload

CVE-2025-4954

Axle Demo Importer <= 1.0.3 - Author+ Arbitrary File Upload PUBLISHED

Description (CNA)

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server

Affected (CNA)

Vendor / product	Versions
Unknown / Axle Demo Importer	affected 0 through 1.0.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/673f35ff-e1d5-4099-86e7-8b6e3e410ef8/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.