CVE-2024-1050: Carazo Import And Export Users And Customers

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.

Affected products

• Carazo Import And Export Users And Customers: up to and including 1.26.5

Published 2024-05-04. Last modified 2026-06-17.