Path Traversal in Export and Import Users and Customers Plugin for WordPress
CVE-2025-1973
4.9MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 March 2025
What is CVE-2025-1973?
The Export and Import Users and Customers plugin for WordPress contains a vulnerability that allows authenticated users with Administrator-level access to exploit the download_file() function. This vulnerability permits them to perform a Path Traversal attack, enabling the unauthorized reading of server log files. Such log files may store sensitive information, potentially compromising the security of the website and its users. All versions up to and including 2.6.2 are affected by this issue, highlighting the need for prompt action to secure the plugin.
Affected Version(s)
Export and Import Users and Customers * <= 2.6.2