Skip to content
Sign in
4.9 Medium

CVE-2025-15673 The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads…

Description

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

Affected products and versions

Product Affected versions Fixed in
Import and export users and customers 2.4 earliest → < 2.4.3 2.4.3

Other CVEs of Import and export users and customers

The 7 CVEs of Import and export users and customers →
CVE-2026-92541 The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in… 7.2 High CVE-2026-92540 The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users… 7.2 High CVE-2026-16542 The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before… 4.1 Medium CVE-2026-16534 The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and… 9.1 Critical
Track this CVE