CVE-2025-12137 | Import WP Plugin up to 2.14.16 on WordPress REST API Endpoint attach_file local_url path traversal

A vulnerability was found in Import WP Plugin up to 2.14.16 on WordPress. It has been classified as problematic. Affected by this issue is the function attach_file of the component REST API Endpoint. The manipulation of the argument local_url leads to path traversal.

This vulnerability is documented as CVE-2025-12137. The attack can be initiated remotely. There is not any exploit available.