Import And Export Users And Customers
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:import_and_export_users_and_customers:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Import And Export Users And Customers (f04fce8c-0c31-52c1-af85-97c73326df9b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-92541 |
vulnerable | 2026-10-13 12:28:53.615803 |
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
Published: 2026-09-20T06:00:18.739Z
Updated: 2026-09-20T13:52:18.349Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-92540 |
vulnerable | 2026-10-13 12:28:53.419666 |
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
Published: 2026-09-20T06:00:18.572Z
Updated: 2026-09-20T13:52:04.112Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16542 |
vulnerable | 2026-10-13 12:28:44.942424 |
Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
Published: 2026-09-20T06:00:15.453Z
Updated: 2026-09-20T13:45:24.876Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16534 |
vulnerable | 2026-09-16 04:32:57.057637 |
Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
Published: 2026-08-03T06:00:10.974Z
Updated: 2026-08-03T17:02:38.751Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-15673 |
vulnerable | 2026-09-16 04:27:17.885386 |
Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Published: 2026-08-03T06:00:11.331Z
Updated: 2026-08-04T17:41:38.682Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3558 |
vulnerable | 2026-06-08 05:48:21.416251 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1255 |
vulnerable | 2026-06-08 05:39:12.500490 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.