CVE-2025-1973

The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.

Score

CVSS 3.1 4.9 Medium

Status

Analyzed - security@wordfence.com

Published

2025-03-22

Last modified

2026-04-08

Weaknesses

CWE-22

Affected products

• Export And Import Users And Customers (Webtoffee)
• Import Export Wordpress Users (Webtoffee)

References

• https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/history…
• https://plugins.trac.wordpress.org/changeset/3259688/
• https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/13b7a2e4-59f4-4d61-a165-a830ccfb696a?source=cve