CVE-2025-15673 PUBLISHED

Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read

Assigner: WPScan
Reserved: 22.07.2026 Published: 03.08.2026 Updated: 03.08.2026

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

Product Status

Vendor Unknown
Product Import and export users and customers
Versions Default: unaffected
  • affected from 0 to 2.4.3 (excl.)

Credits

  • Centesiman finder
  • WPScan coordinator

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE