Skip to content
Noroxi

Export and Import Users and Customers

users-customers-import-export-for-wp-woocommerce · plugin

Known security vulnerabilities for Export and Import Users and Customers. Find out in seconds which version runs on your site with WP Lens.

10 known vulnerabilities

1 exploitable without logging in · latest Mar 22, 2025

Listed on wordpress.org · latest 2.7.5 · last updated Aug 18, 2026 · 60K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-1970admin≤ 2.6.2

    Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

    High 7.6

  • CVE-2025-1971admin≤ 2.6.2

    Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

    High 7.2

  • CVE-2024-13921admin

    Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

    High 7.2

  • CVE-2023-6558shop manager+≤ 2.4.8

    Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload

    High 7.2

  • CVE-2023-3459shop manager+≤ 2.4.1

    Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

    High 7.2

  • CVE-2025-1972admin≤ 2.6.2

    Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Functi

    Medium 6.5

  • CVE-2024-32835unauthenticated≤ 2.5.3

    WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability

    Medium 5.4

  • CVE-2025-1973admin≤ 2.6.2

    Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function

    Medium 4.9

  • CVE-2024-13920admin

    Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Funct

    Medium 4.9

  • CVE-2024-30492login required≤ 2.5.2

    WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory