EUVD-2026-83661
GHSA-h9fx-ggrg-2982
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged WP account
-
DeliveryOpen plugin CSV import
-
ExploitSupply attacker-controlled internal URL
-
ExecutionServer fetches URL unvalidated (SSRF)
-
ImpactReach internal/metadata endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated high-privileged WordPress user (PR:H - capability to run the plugin's user/customer CSV import, effectively administrator). The attacker must supply a URL to the import feature that the plugin then fetches server-side without validation. Limiting factors: exploitation is gated behind high-privilege access (not remote-unauthenticated), impact is limited to confidentiality (SSRF probing/limited data reflection) with no write or availability effect, and value depends on the presence of reachable internal services or a cloud metadata endpoint. Affected only in versions before 2.4.5. |
| Impact | This is a genuinely low-priority issue despite a public exploit existing. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N = 4.1) is the dominant signal: exploitation requires PR:H (a high-privileged WordPress user - effectively admin, since CSV user/customer import is an administrative function), and impact is confined to C:L (limited confidentiality via SSRF response/error reflection) with no integrity or availability impact. A public PoC is confirmed (WPScan) and a vendor patch (2.4.5) is available, but PoC availability is NOT active exploitation - no KEV listing and no EPSS score are provided, so there is no evidence of real-world exploitation. The practical risk is muted because an actor who already holds high privileges on the WordPress instance can typically perform destructive actions directly; the added value of SSRF is pivoting to internal/cloud-metadata endpoints (S:C scope change reflects reaching other systems). No signals conflict here - the low score, high privilege requirement, and limited impact are mutually consistent. Prioritize routine patching rather than emergency response. |
| Exploit ScenarioDerived | An authenticated high-privileged WordPress user (or an attacker who has compromised such an account) initiates a CSV import in the plugin and supplies a URL pointing at an internal service or cloud metadata endpoint (e.g., http://169.254.169.254/). The plugin fetches the URL server-side without validation, letting the attacker probe internal networks or retrieve limited data reflected back through the import flow. A public proof-of-concept is available from WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes the server to fetch an attacker-supplied URL during a CSV import because the plugin fails to validate that URL before making the request. Exploitation is gated behind a high-privileged, authenticated WordPress user with the capability to run the plugin's user/customer CSV import (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so a successful attack yields read-only SSRF probing and limited data reflection rather than code execution or data modification. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the practical impact depends entirely on whether internal services or a cloud metadata endpoint are reachable from the web server - making this a genuinely low-priority issue.
RemediationAI
Vendor-released patch: upgrade Import and Export Users and Customers to version 2.4.5 or later, which remediates the missing URL validation in the CSV import path - this is the only complete fix and should be applied through the standard WordPress plugin update mechanism. If immediate upgrade is not possible, compensating controls are possible but partial: restrict the WordPress roles capable of running the user/customer CSV import to a minimal, fully trusted set of administrators (this reduces the PR:H exposure but does not eliminate it, since the abuse case is precisely a privileged administrator), and block outbound HTTP/HTTPS traffic initiated by the web server to internal RFC1918 ranges, localhost, and the cloud metadata IP 169.254.169.254 (effective against SSRF pivoting but likely to break legitimate import/export or plugin-update functionality and requires egress-firewall or proxy configuration at the host/network layer). Network-level egress filtering and disabling unused import features provide defense in depth with the trade-off of degraded functionality if imports are still needed. Consult the WPScan advisory at https://wpscan.com/vulnerability/f57577b2-3031-433a-a3e1-758d12b244d1/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-16542 for the current status and any updated guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-918 (Server-Side Request Forgery): the plugin's CSV import routine accepts a user-supplied URL and passes it directly to a server-side HTTP client without allow-list, scheme, or host validation. This is a classic WordPress plugin-ecosystem pattern in which import/export functionality is expected to pull remote files, but sanitization of the destination address is omitted. The CVSS scope change (S:C) reflects that the vulnerable component is the plugin itself while the compromised asset is a different, downstream system - internal hosts, admin interfaces, or the cloud instance metadata service - reached over the network from the web server. The vector's PR:H and C:L components confirm that interaction is limited to an already-privileged administrator and that the outcome is information disclosure through request-response observation (timing, status codes, or reflected content), with no integrity or availability effect. The CPE entry supplied (cpe:2.3:a:unknown:import_and_export_users_and_customers:*:*:*:*:*:*:*:*) has no vendor or version bound, so version impact must instead be derived from the EUVD data, which scopes the flaw to Import and Export Users and Customers releases from 0 up to (but excluding) 2.4.5.
Know when Import And Export Users And Customers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
High-privilege import feature drives PR:H; unvalidated server-side fetch reaching other systems yields S:C with limited confidentiality (C:L) and no integrity/availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-priv
Privilege escalation in the WordPress plugin Import and Export Users and Customers (all versions up to and including 2.5
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17)
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an au
Exploit-DB