EUVD-2026-57081
GHSA-q67g-v857-6748
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects two explicit prerequisites: an unconsumed export must exist and a time-based low-entropy key must be derived or brute-forced.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
Articles & Coverage 1
AnalysisAI
Unauthenticated export file disclosure in Import WP WordPress plugin (all versions before 2.14.23) allows any remote attacker to download administrator-generated export files without credentials. The export download handler performs no authorization check, exposing files that may contain user PII including email addresses, login names, and role assignments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be satisfied: (1) an administrator must have generated an export using the Import WP plugin and the resulting export file must still be unconsumed (i.e., not yet downloaded and deleted) on the server at the time of the attack; and (2) the attacker must be able to derive or brute-force the time-based, low-entropy download key, which requires either knowledge of or the ability to estimate the export generation timestamp. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) rates complexity as Low, but the description explicitly introduces two prerequisites that elevate practical difficulty: (1) an unconsumed export file must already exist on the server, meaning an administrator must have generated but not yet retrieved an export; and (2) the attacker must derive or brute-force the low-entropy, time-based download key. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a WordPress site running Import WP observes or infers (via server response timing, log leaks, or enumeration) that an administrator recently generated a user export. Using the publicly available WPScan proof-of-concept, the attacker derives or iterates over candidate time-based download keys within the expected entropy space and sends unauthenticated HTTP GET requests to the unprotected download handler until the correct key is matched and the export file is returned. … |
| Remediation | Upgrade Import WP to version 2.14.23 or later, which is the vendor-confirmed patched release per the WPScan advisory at https://wpscan.com/vulnerability/67be2cc3-06d3-419e-8ca4-6dad442a02ca/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-14925. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations and determine whether Import WP is deployed and its current version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege u
The Import WP - Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Informa
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today