EUVD-2025-210597
GHSA-fghx-qv4v-3qf3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network access with high privileges (admin credentials) required; read-only path traversal yields high confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
AnalysisAI
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
Technical ContextAI
The affected component is a PHP-based WordPress plugin that processes CSV files during user/customer import operations. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) is the root cause: the plugin reads and displays file contents referenced by a user-supplied path without sanitizing or constraining that path to a safe directory. An attacker-controlled path such as '../../../wp-config.php' or absolute paths like '/etc/passwd' can therefore be resolved and returned by the server. The CPE string (cpe:2.3:a:unknown:import_and_export_users_and_customers:*:*:*:*:*:wordpress:*:*) confirms this is a WordPress-ecosystem plugin operating in the web server's PHP process context, giving it access to any file readable by the web server user (typically www-data). Because the scope is Unchanged (S:U), access is limited to the single WordPress instance rather than crossing into adjacent systems.
RemediationAI
Update the 'Import and export users and customers' plugin to version 2.4.3 or later, which is the vendor-released patch resolving this path traversal. The WPScan advisory (https://wpscan.com/vulnerability/b1cf540a-1249-4f51-b9a3-804c77ebfd24/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-15673) both confirm version 2.4.3 as the fix. If an immediate update is not possible, restrict administrative access to the WordPress dashboard - including the plugin's import functionality - to trusted IP ranges using the web server or WAF layer; this does not fix the underlying flaw but raises the bar for exploitation by shrinking the attacker surface to privileged network segments. Enforcing multi-factor authentication on all WordPress admin accounts is a high-value compensating control given that PR:H is the primary exploitation prerequisite. Disabling the plugin entirely until patching is feasible is also an option if the import feature is not actively needed.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allo
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today