EUVD-2026-83661
GHSA-h9fx-ggrg-2982
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
High-privilege import feature drives PR:H; unvalidated server-side fetch reaching other systems yields S:C with limited confidentiality (C:L) and no integrity/availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
AnalysisAI
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes the server to fetch an attacker-supplied URL during a CSV import because the plugin fails to validate that URL before making the request. Exploitation is gated behind a high-privileged, authenticated WordPress user with the capability to run the plugin's user/customer CSV import (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so a successful attack yields read-only SSRF probing and limited data reflection rather than code execution or data modification. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated high-privileged WordPress user (PR:H - capability to run the plugin's user/customer CSV import, effectively administrator). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite a public exploit existing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Import and Export Users and Customers to version 2.4.5 or later, which remediates the missing URL validation in the CSV import path - this is the only complete fix and should be applied through the standard WordPress plugin update mechanism. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-priv
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up t
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allo
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today