CVE-2025-47453 is a high severity local file inclusion flaw (CVSS 8.1) in the WP Smart Import plugin for WordPress, versions through 1.1.3. The plugin builds an include path from input it should not trust. Patchstack lists 1.1.4 as the patched version, so update to 1.1.4 or later.
What's affected
The record says WP Smart Import by Xylus Themes is affected from the first release through 1.1.3. Patchstack's database entry lists 1.1.4 as the patched version.
The CVSS vector rates attack complexity as high, which keeps the score at 8.1 rather than higher. It still lists no privileges and no user interaction, and confidentiality, integrity and availability impact all as high.
The record does not mark CVE-2025-47453 as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On the server, WP-CLI shows the installed version and whether the plugin is active:
wp plugin list --name=wp-smart-import --fields=name,version,status,update
If WP-CLI is not available, open Plugins in the WordPress admin and read the version under the plugin name. Compare it with the affected range above. A deactivated plugin is lower risk than an active one, but it still sits on disk, so remove it if you do not use it.
Also look at what else is installed from the same vendor. If you see other plugins from Xylus Themes, check their versions too.
What to do now
- Update WP Smart Import to 1.1.4 or later. With WP-CLI that is
wp plugin update wp-smart-import. - Take a backup first if the site is busy, and test the update on a staging copy when you can.
- If you do not use the plugin, deactivate and delete it.
- Review your web server logs for odd requests to the plugin's pages if you ran 1.1.3 or older on a public site, and check for files or admin users you do not recognize.
- Review your plugin list for anything else that is out of date. Old plugins are where most WordPress incidents begin.
- Turn on automatic updates for plugins you trust, or add a regular review to your calendar.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record describes improper control of the filename used in an include or require statement, which is CWE-98. In PHP, include and require load a file and run it as code. If an attacker can steer the filename, the site may load a file it was never meant to run. The record calls this a local file inclusion, which means the file comes from the server itself.
The usual cure is to never build an include path from request data, or to accept only values from a fixed list. Patchstack's page notes that vulnerabilities of this kind are used in mass exploitation campaigns in general. It does not say this specific one has been exploited, and neither does the record, so treat that as context and not as a report of attacks.
WordPress plugins run with the same trust as the rest of the site. A weakness in one small add on is a weakness in the whole install, and plugin flaws are easy to find at scale because the code is public and the plugin slugs are predictable.
Quick check
Which version fixes CVE-2025-47453?
Patchstack lists WP Smart Import 1.1.4 as the patched version. Update to 1.1.4 or later.
What does local file inclusion mean here?
The plugin can be pushed into loading a file from the server itself and running it as PHP. Remote file inclusion would load a file from another host.
Sources
Last reviewed: 18 October 2026.
