Data Exposure Vulnerability in Comments Import & Export Plugin for WordPress
CVE-2026-87836
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 17 September 2026
Badges
What is CVE-2026-87836?
The Comments Import & Export plugin for WordPress versions prior to 2.5.4 suffers from a significant data exposure issue, allowing users with the Author role and above to export all comments across the site. This includes sensitive information such as commenter email addresses, IP addresses, and even unapproved comments that should remain private. The vulnerability arises from the plugin's lack of restrictions on comment export capabilities, failing to limit access to comments owned by the requesting user or to users authorized to manage comments.
Affected Version(s)
Comments Import & Export 2.1.11 < 2.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.