Path Traversal in Export and Import Users and Customers Plugin for WordPress
CVE-2025-1973

4.9MEDIUM

Key Information:

Vendor

WordPress

Vendor
CVE Published:
22 March 2025

What is CVE-2025-1973?

The Export and Import Users and Customers plugin for WordPress contains a vulnerability that allows authenticated users with Administrator-level access to exploit the download_file() function. This vulnerability permits them to perform a Path Traversal attack, enabling the unauthorized reading of server log files. Such log files may store sensitive information, potentially compromising the security of the website and its users. All versions up to and including 2.6.2 are affected by this issue, highlighting the need for prompt action to secure the plugin.

Affected Version(s)

Export and Import Users and Customers * <= 2.6.2

References

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hay Mizrachi
.
CVE-2025-1973 : Path Traversal in Export and Import Users and Customers Plugin for WordPress