Import And Export Users And Customers
CVE-2023-6583
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 6.6 (MEDIUM). Attack characteristics: network attack vector, high complexity, high privileges required, no user interaction not required. EPSS exploitation probability: 1.90%. |
| Exploit ScenarioDerived | A remote attacker could access files and directories outside the intended path by sending crafted requests to the affected application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Earlier versions of this analysis (1)
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it p
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information. Affected products include: Codection Import And Export Users And Customers.
Know when Import And Export Users And Customers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.
Executive ViewAI
Organizations using for WordPress is vulnerable to Directory Traversal in all should be aware of notable risk from CVE-2023-6583, a path traversal vulnerability rated CVSS 6.6. This could allow unauthorized file access. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-priv
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17)
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an au
GitHub PoC
Exploit-DB