Import WP EUVD-2026-57081

Two specific conditions must both be satisfied: (1) an administrator must have generated an export using the Import WP plugin and the resulting export file must still be unconsumed (i.e., not yet downloaded and deleted) on the server at the time of the attack; and (2) the attacker must be able to derive or brute-force the time-based, low-entropy download key, which requires either knowledge of or the ability to estimate the export generation timestamp. Sites that never use the export functionality are not exploitable regardless of plugin version. Authentication is not required (CVSS PR:N confirmed). No user interaction is needed. The limiting factors are: export file must exist on-disk and key entropy must be low enough to enumerate within practical time constraints. Sites that generate exports infrequently or in environments where timing cannot be observed have significantly lower real-world exposure than the CVSS score alone suggests.

The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) rates complexity as Low, but the description explicitly introduces two prerequisites that elevate practical difficulty: (1) an unconsumed export file must already exist on the server, meaning an administrator must have generated but not yet retrieved an export; and (2) the attacker must derive or brute-force the low-entropy, time-based download key. These conditions conflict with an AC:L rating and suggest the real-world attack complexity is higher - an independent assessment of AC:H is more appropriate. EPSS at 16% indicates above-average exploitation probability relative to the broader CVE corpus, consistent with a publicly available exploit from WPScan. No CISA KEV listing exists, so active mass exploitation is not confirmed. The net risk profile is: meaningful threat for sites that regularly run administrator exports and where export timing is observable or guessable, but not a fire-drill for sites that never use the export feature.

An attacker targeting a WordPress site running Import WP observes or infers (via server response timing, log leaks, or enumeration) that an administrator recently generated a user export. Using the publicly available WPScan proof-of-concept, the attacker derives or iterates over candidate time-based download keys within the expected entropy space and sends unauthenticated HTTP GET requests to the unprotected download handler until the correct key is matched and the export file is returned. The downloaded file contains all exported user records including email addresses, usernames, and role assignments, which can be used for credential stuffing, targeted phishing, or further account enumeration.