File Path Disclosure in Import and Export Users and Customers Plugin for WordPress
CVE-2025-15673
Currently unrated
What is CVE-2025-15673?
The Import and Export Users and Customers plugin for WordPress versions earlier than 2.4.3 contains a vulnerability that allows high-privileged users to leverage insufficient restrictions on file paths during CSV imports. This flaw enables them to read sensitive files from the server, potentially exposing critical data and jeopardizing the security of the entire application.
Affected Version(s)
Import and export users and customers 0 < 2.4.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.