PHP Object Injection in Users and Customers Import/Export Plugin for WordPress

CVE-2025-1971

Summary

The Users and Customers Import and Export plugin for WordPress is prone to a PHP Object Injection vulnerability, affecting all versions up to and including 2.6.2. This flaw arises from the deserialization of untrusted input received via the 'form_data' parameter, allowing authenticated attackers with Administrator-level access and above to inject PHP objects. While there is no inherent exploit in the plugin itself without the presence of a PHP Object Injection (POP) chain provided by another plugin or theme, if a vulnerable chain is discovered, it could enable the attacker to execute malicious actions such as deleting files, stealing sensitive information, or executing arbitrary code. Users are urged to take appropriate measures to mitigate risks associated with this vulnerability.

References