Import Export WordPress Users <= 2.5.2 - Authenticated (Shop Manager+) Path Traversal

Wordfence Intelligence   >   Vulnerability Database   >   Import Export WordPress Users <= 2.5.2 - Authenticated (Shop Manager+) Path Traversal
2.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE CVE-2024-30492
CVSS 2.7 (Low)
Publicly Published March 28, 2024
Last Updated April 4, 2024
Researcher Ananda Dhakal

Description

The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

References

Share

Vulnerability Details for Export and Import Users and Customers

Export and Import Users and Customers

Software Type Plugin
Software Slug users-customers-import-export-for-wp-woocommerce (view on wordpress.org)
Patched? Yes
Remediation Update to version 2.5.3, or a newer patched version
Affected Version
  • <= 2.5.2
Patched Version
  • 2.5.3

Recent vulnerabilities in Export and Import Users and Customers

Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
4.9
CVE-2025-1973
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
2.7
CVE-2025-1972
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
7.2
CVE-2025-1971
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
7.6
CVE-2025-1970
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.5.3 - Authenticated (Admin+) PHP Object Injection
7.2
CVE-2024-32835
Apr 22, 2024
Researcher: Trình Vũ
Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload
7.2
CVE-2023-6558
Dec 12, 2023
Researcher: István Márton
Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change
7.2
CVE-2023-3459
Jul 14, 2023
Researcher: István Márton
WebToffee Plugins <= (Various Versions) - Arbitrary User Creation
8.8
CVE-2020-12074
Mar 11, 2020
Researcher: Chloe Chamberland
Import Export WordPress Users and WooCommerce Customers <= 1.3.1 - CSV Injection
7.3
CVE-2019-15092
Aug 22, 2018
Researcher: Javier Olmedo
# Title CVE ID CVSS Researchers Date
1 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function CVE-2025-1973 4.9 HayMiz March 21, 2025
2 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function CVE-2025-1972 2.7 HayMiz March 21, 2025
3 Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter CVE-2025-1971 7.2 HayMiz March 21, 2025
4 Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function CVE-2025-1970 7.6 HayMiz March 21, 2025
5 Export and Import Users and Customers <= 2.5.3 - Authenticated (Admin+) PHP Object Injection CVE-2024-32835 7.2 Trình Vũ April 22, 2024
6 Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload CVE-2023-6558 7.2 István Márton December 12, 2023
7 Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change CVE-2023-3459 7.2 István Márton July 14, 2023
8 WebToffee Plugins <= (Various Versions) - Arbitrary User Creation CVE-2020-12074 8.8 Chloe Chamberland March 11, 2020
9 Import Export WordPress Users and WooCommerce Customers <= 1.3.1 - CSV Injection CVE-2019-15092 7.3 Javier Olmedo August 22, 2018
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation