Path Traversal in Export and Import Users and Customers Plugin for WordPress

CVE-2025-1973

What is CVE-2025-1973?

The Export and Import Users and Customers plugin for WordPress contains a vulnerability that allows authenticated users with Administrator-level access to exploit the download_file() function. This vulnerability permits them to perform a Path Traversal attack, enabling the unauthorized reading of server log files. Such log files may store sensitive information, potentially compromising the security of the website and its users. All versions up to and including 2.6.2 are affected by this issue, highlighting the need for prompt action to secure the plugin.

References