WordPress Plugin Vulnerabilities

Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read

Description

The plugin does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

Proof of Concept

Affects Plugins

Plugin icon
import-users-from-csv-with-meta
Fixed in 2.4.3

References

CVE
CVE-2025-15673

Classification

Type
TRAVERSAL
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
Centesiman
Submitter
Centesiman
Verified
Yes
WPVDB ID
b1cf540a-1249-4f51-b9a3-804c77ebfd24

Timeline

Publicly Published
2026-07-24 (about 11 days ago)
Added
2026-07-24 (about 10 days ago)
Last Updated
2026-07-24 (about 10 days ago)

Other

Published
Title
Published
2019-02-14
Title
WP Cost Estimation < 9.660 - Upload Directory Traversal
Published
2020-03-13
Title
WordPress File Upload < 4.13.0 - Directory Traversal to RCE
Published
2021-10-29
Title
Download Monitor < 4.4.7 - Admin+ Arbitrary File Download
Published
2026-01-13
Title
Anona <= 8.0 - Unauthenticated Arbitrary File Download
Published
2022-03-01
Title
WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE