Webtoffee Import Export Wordpress Users vulnerabilities

CVE-2019-15092 [HIGH] CWE-1236 CVE-2019-15092: The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress all The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.

CVE-2020-12074 [HIGH] CWE-269 CVE-2020-12074: The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscr The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.

CVE-2023-6558 [HIGH] CWE-434 CVE-2023-6558: The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploa The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the af

CVE-2023-3459 [HIGH] CWE-863 CVE-2023-3459: The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modific The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user

CVE-2025-1970 [HIGH] CWE-918 CVE-2025-1970: The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web applic

CVE-2025-1971 [HIGH] CWE-502 CVE-2025-1971: The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain i

CVE-2025-1972 [MEDIUM] CWE-73 CVE-2025-1972: The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file delet The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the

CVE-2024-32835 [MEDIUM] CWE-502 CVE-2024-32835: Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issu Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.

CVE-2025-1973 [MEDIUM] CWE-22 CVE-2025-1973: The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in al The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive

CVE-2024-30492 [MEDIUM] CWE-22 CVE-2024-30492: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebT Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.