Import And Export Users And Customers
Monthly
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an authenticated Editor-level account to assign itself or another user the administrator role by abusing the plugin's user import/export functionality, a CWE-266 incorrect privilege assignment flaw rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional: the attacker needs a pre-existing high-privilege account (Editor or comparable), the plugin installed and active, and no user interaction is required once that session exists. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, so the practical risk is a serious but situational escalation on multi-author or multi-tenant WordPress sites that delegate Editor accounts to less-trusted users rather than a broad internet-facing emergency.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and including 2.5.2 lets an authenticated low-privileged account - specifically a Subscriber - reach higher-privileged roles, giving full compromise of the site's confidentiality, integrity, and availability (CVSS 3.1 base 7.5, High). The advisory-supplied vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attack is network-reachable and needs no victim interaction, but the High Attack Complexity rating reflects a non-trivial precondition (a specific plugin state, ordering, or crafted import payload) that limits how reliably it can be pulled off; it does require the attacker to already hold a Subscriber account, which is trivial on sites with open registration enabled. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as a targeted-risk rather than a mass-scanning risk; no EPSS probability was supplied with this record.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17) allows any authenticated user at Subscriber level or above to become an Administrator. The attacker stores crafted values in their own display_name and nickname profile fields and then waits for a site administrator to run the plugin's documented export-then-reimport migration with both 'Update existing users' and 'Update roles for existing users' set to 'yes'; a CSV quoting/escape mismatch between exporter and importer causes the crafted display_name to be consumed as the role field, yielding 'administrator' at the importer's add_role call. Exploitation is not self-contained - it requires the operator to enable those two non-default migration settings - and no public exploit identified at time of analysis. The vendor risk score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment re-rates it as AV:N/AC:H/PR:L/UI:R because the admin-driven, non-default migration workflow materially constrains real-world exploitation.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to gain Administrator privileges. All versions up to and including 1.29.7 are affected. The vulnerability can only be exploited when specific configuration conditions are met (the 'Show fields in profile' setting is enabled and a CSV with wp_capabilities column has been previously imported), which increases attack complexity but does not eliminate the critical risk.
Stored cross-site scripting in the Codection 'Import and export users and customers' WordPress plugin (import-users-from-csv-with-meta) allows an attacker holding a low-privileged authenticated account on a target site to persist script content that executes in another user's browser when that page is rendered. All versions through 2.5.9 are affected, per the Patchstack-reported CVE-2026-54862, which carries CVSS 3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The flaw is not remote-unauthenticated and does not self-trigger: it depends on a victim viewing the stored content, and no public exploit code, PoC reference, or CISA KEV entry is present in the available data, so no public exploit was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin "Import and export users and customers" (all versions through 2.4.5) lets authenticated attackers holding only custom-level access inject persistent JavaScript through Custom Column User Meta Profile Fields, which then executes whenever a page rendering that meta is viewed - typically by a higher-privileged administrator reviewing user records. The Wordfence-assigned CVSS of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a low-privilege, network-reachable flaw with limited confidentiality and integrity impact but a scope change, because script executes in the context of the reviewing user's session rather than the attacker's own. Exploitation is constrained by the need for prior authentication, an account permitted to write custom user meta, and a victim subsequently loading the injected page, so sites that run this plugin and issue accounts to untrusted users (membership sites, multi-author blogs, customer-facing stores) carry the real risk; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes the server to fetch an attacker-supplied URL during a CSV import because the plugin fails to validate that URL before making the request. Exploitation is gated behind a high-privileged, authenticated WordPress user with the capability to run the plugin's user/customer CSV import (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so a successful attack yields read-only SSRF probing and limited data reflection rather than code execution or data modification. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the practical impact depends entirely on whether internal services or a cloud metadata endpoint are reachable from the web server - making this a genuinely low-priority issue.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allows any authenticated subscriber-level user to enumerate and extract the post_title and raw post_content of arbitrary posts regardless of visibility status or post type. Affected content includes drafts, private posts, password-protected entries, future-scheduled posts, trashed items, and non-public custom post types such as WooCommerce orders and internal CRM records. The exploit barrier is exceptionally low: the required security nonce is leaked as inline JavaScript on any wp-admin page reachable by subscribers. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an authenticated Editor-level account to assign itself or another user the administrator role by abusing the plugin's user import/export functionality, a CWE-266 incorrect privilege assignment flaw rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional: the attacker needs a pre-existing high-privilege account (Editor or comparable), the plugin installed and active, and no user interaction is required once that session exists. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, so the practical risk is a serious but situational escalation on multi-author or multi-tenant WordPress sites that delegate Editor accounts to less-trusted users rather than a broad internet-facing emergency.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and including 2.5.2 lets an authenticated low-privileged account - specifically a Subscriber - reach higher-privileged roles, giving full compromise of the site's confidentiality, integrity, and availability (CVSS 3.1 base 7.5, High). The advisory-supplied vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attack is network-reachable and needs no victim interaction, but the High Attack Complexity rating reflects a non-trivial precondition (a specific plugin state, ordering, or crafted import payload) that limits how reliably it can be pulled off; it does require the attacker to already hold a Subscriber account, which is trivial on sites with open registration enabled. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as a targeted-risk rather than a mass-scanning risk; no EPSS probability was supplied with this record.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17) allows any authenticated user at Subscriber level or above to become an Administrator. The attacker stores crafted values in their own display_name and nickname profile fields and then waits for a site administrator to run the plugin's documented export-then-reimport migration with both 'Update existing users' and 'Update roles for existing users' set to 'yes'; a CSV quoting/escape mismatch between exporter and importer causes the crafted display_name to be consumed as the role field, yielding 'administrator' at the importer's add_role call. Exploitation is not self-contained - it requires the operator to enable those two non-default migration settings - and no public exploit identified at time of analysis. The vendor risk score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment re-rates it as AV:N/AC:H/PR:L/UI:R because the admin-driven, non-default migration workflow materially constrains real-world exploitation.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to gain Administrator privileges. All versions up to and including 1.29.7 are affected. The vulnerability can only be exploited when specific configuration conditions are met (the 'Show fields in profile' setting is enabled and a CSV with wp_capabilities column has been previously imported), which increases attack complexity but does not eliminate the critical risk.
Stored cross-site scripting in the Codection 'Import and export users and customers' WordPress plugin (import-users-from-csv-with-meta) allows an attacker holding a low-privileged authenticated account on a target site to persist script content that executes in another user's browser when that page is rendered. All versions through 2.5.9 are affected, per the Patchstack-reported CVE-2026-54862, which carries CVSS 3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The flaw is not remote-unauthenticated and does not self-trigger: it depends on a victim viewing the stored content, and no public exploit code, PoC reference, or CISA KEV entry is present in the available data, so no public exploit was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin "Import and export users and customers" (all versions through 2.4.5) lets authenticated attackers holding only custom-level access inject persistent JavaScript through Custom Column User Meta Profile Fields, which then executes whenever a page rendering that meta is viewed - typically by a higher-privileged administrator reviewing user records. The Wordfence-assigned CVSS of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a low-privilege, network-reachable flaw with limited confidentiality and integrity impact but a scope change, because script executes in the context of the reviewing user's session rather than the attacker's own. Exploitation is constrained by the need for prior authentication, an account permitted to write custom user meta, and a victim subsequently loading the injected page, so sites that run this plugin and issue accounts to untrusted users (membership sites, multi-author blogs, customer-facing stores) carry the real risk; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes the server to fetch an attacker-supplied URL during a CSV import because the plugin fails to validate that URL before making the request. Exploitation is gated behind a high-privileged, authenticated WordPress user with the capability to run the plugin's user/customer CSV import (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so a successful attack yields read-only SSRF probing and limited data reflection rather than code execution or data modification. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the practical impact depends entirely on whether internal services or a cloud metadata endpoint are reachable from the web server - making this a genuinely low-priority issue.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-privileged WordPress users to read arbitrary files on the underlying server by supplying a crafted file path during the CSV import workflow. Confidentiality impact is rated High by NVD (CVSS:3.1 C:H), exposing sensitive server files such as wp-config.php, /etc/passwd, or application secrets. A publicly available proof-of-concept exists via WPScan, though EPSS sits at a low 0.16% (6th percentile), indicating that mass exploitation has not materialized despite POC disclosure - likely because high-privilege access is a prerequisite.
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allows any authenticated subscriber-level user to enumerate and extract the post_title and raw post_content of arbitrary posts regardless of visibility status or post type. Affected content includes drafts, private posts, password-protected entries, future-scheduled posts, trashed items, and non-public custom post types such as WooCommerce orders and internal CRM records. The exploit barrier is exceptionally low: the required security nonce is leaked as inline JavaScript on any wp-admin page reachable by subscribers. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.