Arbitrary File Deletion Vulnerability in Export and Import Users and Customers Plugin for WordPress
CVE-2025-1972

2.7LOW

Key Information:

Vendor
WordPress
Status
Export And Import Users And Customers
Vendor
CVE Published:
22 March 2025

Summary

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to a flaw in the file path validation within the admin_log_page() function. This vulnerability affects all versions up to and including 2.6.2 and can be exploited by authenticated users with administrative privileges, allowing them to delete any log file on the server. This could lead to significant security risks as attackers may erase crucial logs that could assist in detecting further intrusions.

Affected Version(s)

Export and Import Users and Customers * <= 2.6.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/users-customer...
https://wordpress.org/plugins/users-customers-import-expo...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hay Mizrachi
.