Path Traversal in Export and Import Users and Customers Plugin for WordPress

CVE-2025-1973

What is CVE-2025-1973?

The Export and Import Users and Customers plugin for WordPress contains a vulnerability that allows authenticated users with Administrator-level access to exploit the download_file() function. This vulnerability permits them to perform a Path Traversal attack, enabling the unauthorized reading of server log files. Such log files may store sensitive information, potentially compromising the security of the website and its users. All versions up to and including 2.6.2 are affected by this issue, highlighting the need for prompt action to secure the plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References