CVE-2025-15673 — Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged …
Published: 2026-08-03 · CVSS: 4.9 · CVSS 3.1
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7