CVE-2026-16542
Received Received - Intake

Server-Side Request Forgery in Import and Export Users and Customers WordPress Plugin

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: WPScan

Description
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-16542
EUVD
EUVD-2026-83661

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
import_and_export_users_and_customers import_and_export_users_and_customers to 2.4.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) issue in the Import and export users and customers WordPress plugin before version 2.4.5. It occurs because the plugin does not properly validate user-supplied URLs during CSV import operations. High-privileged users (Admin+) can exploit this to manipulate server-side requests and access internal resources.

Detection Guidance

Check the installed version of the Import and export users and customers WordPress plugin. If it is below 2.4.5, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin directory for version details.

Impact Analysis

If you are an administrator using this plugin, an attacker with admin access could exploit this to make unauthorized requests to internal systems. This may lead to data leaks, unauthorized access to sensitive information, or further network compromise within your environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations must address this flaw to maintain regulatory compliance and protect sensitive data.

Mitigation Strategies

Update the Import and export users and customers plugin to version 2.4.5 or later immediately. Restrict high-privileged user access to trusted sources only and monitor for unusual server-side requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart