Authorization Bypass in Import WP Plugin Affects WordPress Users
CVE-2026-14925
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14925?
The Import WP plugin prior to version 2.14.23 is susceptible to an authorization bypass flaw, which permits unauthenticated attackers to download export files that were generated by administrators. These files may unintentionally expose sensitive user information, including email addresses, login names, and roles. To exploit this vulnerability, an export file must exist, along with a weak, time-based download key that can potentially be gained by attackers.
Affected Version(s)
Import WP 0 < 2.14.23
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.