Arbitrary File Deletion Vulnerability in Export and Import Users and Customers Plugin for WordPress

CVE-2025-1972

What is CVE-2025-1972?

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to a flaw in the file path validation within the admin_log_page() function. This vulnerability affects all versions up to and including 2.6.2 and can be exploited by authenticated users with administrative privileges, allowing them to delete any log file on the server. This could lead to significant security risks as attackers may erase crucial logs that could assist in detecting further intrusions.

References