CVE-2026-16542 PUBLISHED

Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

Assigner: WPScan
Reserved: 22.07.2026 Published: 20.09.2026 Updated: 20.09.2026

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

Product Status

Vendor Unknown
Product Import and export users and customers
Versions Default: unaffected
  • affected from 0 to 2.4.5 (excl.)

Credits

  • Binesh Madharapu finder
  • WPScan coordinator

References

Problem Types

  • CWE-918 Server-Side Request Forgery (SSRF) CWE