Arbitrary File Deletion Vulnerability in Export and Import Users and Customers Plugin for WordPress
CVE-2025-1972
2.7LOW
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 March 2025
What is CVE-2025-1972?
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to a flaw in the file path validation within the admin_log_page() function. This vulnerability affects all versions up to and including 2.6.2 and can be exploited by authenticated users with administrative privileges, allowing them to delete any log file on the server. This could lead to significant security risks as attackers may erase crucial logs that could assist in detecting further intrusions.
Affected Version(s)
Export and Import Users and Customers * <= 2.6.2