8.8
High
CVE-2025-4954 The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow…
Description
The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Axle Demo Importer 1.0 | earliest → 1.0.3 | No fix stated |