Import And Export Users And Customers
Monthly
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to gain Administrator privileges. All versions up to and including 1.29.7 are affected. The vulnerability can only be exploited when specific configuration conditions are met (the 'Show fields in profile' setting is enabled and a CSV with wp_capabilities column has been previously imported), which increases attack complexity but does not eliminate the critical risk.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allows any authenticated subscriber-level user to enumerate and extract the post_title and raw post_content of arbitrary posts regardless of visibility status or post type. Affected content includes drafts, private posts, password-protected entries, future-scheduled posts, trashed items, and non-public custom post types such as WooCommerce orders and internal CRM records. The exploit barrier is exceptionally low: the required security nonce is leaked as inline JavaScript on any wp-admin page reachable by subscribers. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to gain Administrator privileges. All versions up to and including 1.29.7 are affected. The vulnerability can only be exploited when specific configuration conditions are met (the 'Show fields in profile' setting is enabled and a CSV with wp_capabilities column has been previously imported), which increases attack complexity but does not eliminate the critical risk.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allows any authenticated subscriber-level user to enumerate and extract the post_title and raw post_content of arbitrary posts regardless of visibility status or post type. Affected content includes drafts, private posts, password-protected entries, future-scheduled posts, trashed items, and non-public custom post types such as WooCommerce orders and internal CRM records. The exploit barrier is exceptionally low: the required security nonce is leaked as inline JavaScript on any wp-admin page reachable by subscribers. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.