Cyber Resilience

CVE-2025-4190

HighPublic PoC

Published: 17 May 2025

Published
17 May 2025
Modified
12 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0018 39.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-4190 is a high-severity an unspecified weakness vulnerability in Aleapp Csv Mass Importer. Its CVSS base score is 7.2 (High).

Operationally, ranked at the 39.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite…

more

setup)

CWE(s)
NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

aleapp
csv mass importer
≤ 1.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References