CVE-2025-15673: Unknown Import And Export Users And Customers

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

Affected products

• Unknown Import And Export Users And Customers: before 2.4.3 (fixed in 2.4.3)

Published 2026-08-03. Last modified 2026-09-29.