Import Export Users CVE-2025-15673

Exploitation requires an authenticated WordPress session with high-privilege role - specifically, a user with access to the plugin's import functionality, which in typical WordPress installations means Administrator or a role explicitly granted import capabilities. The attacker must have valid credentials for such an account (PR:H per CVSS vector). The 'Import and export users and customers' plugin must be installed and active on the target site. No special server-side configuration beyond the plugin's presence is needed - the flaw exists in the plugin's default file-reading behavior. What limits exploitation: (1) requires control of a high-privilege WordPress account, ruling out unauthenticated or low-privilege attackers; (2) scope is Unchanged, so impact is confined to files readable by the web server process on the WordPress host - it does not cross into other systems; (3) read-only confidentiality impact with no write capability from this vulnerability alone.

The CVSS base score of 4.9 (Medium) accurately reflects the constrained real-world threat surface. The PR:H metric is the critical limiting factor: exploitation requires an authenticated WordPress user with high privileges - typically an Administrator or Shop Manager - which substantially reduces the attacker population to insider threats, compromised admin accounts, or privilege-escalation chains. The AC:L and AV:N metrics indicate that once those credentials are in hand, the exploit is straightforward and remotely executable. EPSS at 0.16% (6th percentile) confirms empirically low exploitation interest despite a publicly available POC from WPScan. There is no CISA KEV listing, reinforcing that this is not being actively mass-exploited. The C:H rating is credible given that a successful read of wp-config.php would expose database credentials, authentication keys, and salts - enabling full site compromise even from this single read primitive. Risk priority is MODERATE for environments where admin account compromise is a realistic threat, and LOW for hardened environments with MFA enforced on admin accounts.

A threat actor who has gained WordPress Administrator credentials - through phishing, credential stuffing, or a prior privilege escalation - navigates to the plugin's CSV import interface and submits a crafted CSV file referencing a server-side path such as /var/www/html/wp-config.php or /etc/passwd. The plugin reads and displays the target file contents, returning database credentials, secret keys, and salts that allow the attacker to escalate to full database and application compromise. A publicly available proof-of-concept documented by WPScan demonstrates this technique.