Introduction
Attackers with Author-level credentials can upload malicious files to vulnerable WordPress sites. On a misconfigured server, that can lead to remote code execution. The vulnerability is in the URL Image Importer plugin, which is meant to simplify WordPress media management by letting users import images from external URLs directly into the media library.
About the plugin and vendor: URL Image Importer is developed by Infinite Uploads, a company that builds WordPress media management tools. The plugin was first released in January 2025 and belongs to a suite of tools that simplify file handling for WordPress administrators and agencies. It is not as widely adopted as some long-established plugins, but it covers a common WordPress workflow.
Technical information
CVE-2025-12138 is an arbitrary file upload vulnerability in the URL Image Importer plugin for WordPress. It affects all versions up to and including 1.0.6. The flaw is in the uimptr_import_image_from_url() function, which imports images from user-supplied URLs. To validate the file type, the function trusts the Content-Type HTTP header that the user sends, and an attacker can easily change that header.
The vulnerable code path writes the file to the server before it validates the file adequately. An attacker with Author-level access or higher can send a request with a crafted Content-Type header (such as image/jpeg) while the uploaded file actually contains executable PHP code. If the server is configured to execute PHP files in the uploads directory, the result can be remote code execution.
Relevant code locations:
The root cause is insufficient server-side validation of file content, combined with too much trust in user-supplied HTTP headers. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
Affected systems and versions
- Product: URL Image Importer plugin for WordPress
- Affected versions: All versions up to and including 1.0.6
- Vulnerable configuration: Any WordPress site with the plugin installed and active, where users with Author-level or higher access can use the import feature
Vendor security history
No major vulnerabilities have previously been reported in the URL Image Importer plugin or in other Infinite Uploads products. The vendor released a patched version (1.0.7) promptly after disclosure.
