CVE-2026-16542
UnknownSummary
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
Risk Assessment
An SSRF attack may enable access to internal network resources or services that should not be reachable by an external user.
Recommendation
Update the Import and export users and customers plugin to version 2.4.5 or later.
Other vulnerabilities in Import and export users and customers WordPress plugin
See all- CVE-2026-92541Unknown
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality. This allows users with only the create_users capability to change the role of existing users, including promoting them to administrator.
- CVE-2026-92540Unknown
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import. This allows users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
- CVE-2025-15673Medium
The Import and export users and customers WordPress plugin before version 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Original NVD description (English source)
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.