CVE-2025-15673
Received Received - Intake

CSV Import Arbitrary File Read in Users Customers WordPress Plugin

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: WPScan

Description
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2025-15673
EUVD
EUVD-2025-210597

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
import_and_export_users_and_customers plugin to 2.4.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Import and export users and customers WordPress plugin before version 2.4.3. It allows high-privileged users to read arbitrary files on the server by not restricting the file path during a CSV import operation.

Impact Analysis

If you are a high-privileged user of the affected WordPress site, an attacker could exploit this to read sensitive files on the server, potentially exposing confidential data such as configuration files, user credentials, or other sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict data protection and access controls.

Mitigation Strategies

Update the Import and export users and customers WordPress plugin to version 2.4.3 or later to address the file path restriction issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart