Unknown Import And Export Users And Customers vulnerabilities

5 CVEs affecting Unknown Import And Export Users And Customers, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92541, published 2026-09-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-15673, published 2026-08-03. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read…
CVE-2026-92541, published 2026-09-20. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users…
CVE-2026-92540, published 2026-09-20. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the…
CVE-2026-16534, published 2026-08-03. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the…
CVE-2026-16542, published 2026-09-20. Medium severity, CVSS 4.1. EPSS: 0.2% chance of exploitation in the next 30 days. The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to…