CVE-2025-15673
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Import and export users and customers WordPress plugin before version 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Risk Assessment
A high-privileged user (e.g., administrator) can read sensitive system files such as configurations, passwords, or other users' data, compromising system confidentiality and integrity.
Recommendation
Update the Import and export users and customers plugin to version 2.4.3 or later. Restrict access to the import functionality to trusted administrators only.
Other vulnerabilities in Import and export users and customers WordPress plugin
See all- CVE-2026-92541Unknown
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality. This allows users with only the create_users capability to change the role of existing users, including promoting them to administrator.
- CVE-2026-92540Unknown
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import. This allows users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
- CVE-2026-16542Unknown
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
Original NVD description (English source)
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.