webtoffee import export wordpress users vulnerabilities

Latest webtoffee import export wordpress users CVEs

Newest publication first

1. CVE-2025-1973 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function

   Published 2025-03-22

   Medium·CVSS 4.9 EPSS 0.75%

   The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the...

2. CVE-2025-1970 Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

   Published 2025-03-22

   High·CVSS 7.6 EPSS 0.42%

   The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above,...

3. CVE-2025-1971 Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

   Published 2025-03-22

   High·CVSS 7.2 EPSS 0.75%

   The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Adminis...

4. CVE-2025-1972 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function

   Published 2025-03-22

   Medium·CVSS 6.5 EPSS 0.40%

   The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with...

5. CVE-2024-32835 WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability

   Published 2024-04-24

   Medium·CVSS 5.4 EPSS 0.36%

   Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.

6. CVE-2024-30492 WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability

   Published 2024-03-29

   Medium·CVSS 4.3 EPSS 0.52%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.

7. CVE-2023-6558 Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload

   Published 2024-01-11

   High·CVSS 7.2 EPSS 1.4%

   The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with sh...

8. CVE-2023-3459 Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

   Published 2023-07-18

   High·CVSS 7.2 EPSS 0.93%

   The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for a...

9. CVE-2020-12074 Product Import Export for WooCommerce <= 1.7.4 - Missing Authorization to CSV Import

   Published 2020-04-23

   High·CVSS 8.8 EPSS 1.7%

   The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.

10. CVE-2019-15092 Import Export WordPress Users and WooCommerce Customers <= 1.3.1 - CSV Injection

    Published 2019-08-23

    High·CVSS 7.3 EPSS 5.1% Public exploit

    The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.