2.7Low

CVE-2025-1972Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function

webtoffee Export and Import Users and Customers Published: 2025-03-22 14:18 (1 year ago)

Description

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.

Weakness (CWE): CWE-73

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
webtoffee	Export and Import Users and Customers	≤ 2.6.2
webtoffee	import export wordpress users	< 2.6.3

References and patches

CPE matches (NVD) (1)

cpe:2.3:a:webtoffee:import_export_wordpress_users:*:*:*:*:*:wordpress:*:* < 2.6.3

CVSS score

2.7Low

Source: Wordfence · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

All scores (3)

cna	CVSS 3.1	2.7Low
security@wordfence.com	CVSS 3.1	2.7Low
nvd	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.40%

higher than 35% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-03-04
Published2025-03-22 14:18
Reached IP-DB2026-10-24 23:59
Last updated2026-06-17 11:40

Assigned by (CNA): Wordfence
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

7.5High

CVE-2026-82663 1 hour ago

Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload

GiveWP Give - Peer-to-Peer

The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthe…

7.5High

CVE-2026-82568 1 hour ago

Give - Peer-to-Peer <= 2.9.3 - Unauthenticated SQL Injection via 'sort' Parameter

GiveWP Give - Peer-to-Peer

The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the e…

Unscored

CVE-2026-127048 4 hours ago

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…

Unscored

CVE-2026-124673 4 hours ago

Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclo…

Unscored

CVE-2026-124671 4 hours ago

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather th…

Unscored

CVE-2026-123707 4 hours ago

WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

WPGraphQL

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.