CVE-2026-14925

Deferred Deferred - Pending Action

Import WP Plugin Unauthorized Export File Download

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-14925

EUVD

EUVD-2026-57081

Affected Vendors & Products

Vendor	Product	Version / Range
import_wp	import_wp	to 2.14.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The Import WP WordPress plugin before version 2.14.23 has a vulnerability where it does not verify authorization before allowing downloads of export files created by administrators. This lets unauthenticated attackers access these files if they exist and have a low-entropy download key.

Detection Guidance

Check if the Import WP plugin version is below 2.14.23. Look for unauthorized export file downloads in server logs. Verify if export files containing user data are accessible without proper authentication.

Impact Analysis

Attackers could steal sensitive user data like email addresses, login names, and roles from export files. This could lead to privacy breaches, identity theft, or unauthorized access to user accounts if the data is misused.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information if present. Organizations may face fines or legal penalties for non-compliance due to unauthorized data disclosure.

Mitigation Strategies

Update the Import WP plugin to version 2.14.23 or later immediately. Review and remove any existing export files that may contain sensitive data. Monitor network traffic for unauthorized download attempts.

Hi! I’m here to help you understand CVE-2026-14925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70