Veille CVE

Recherche « Unknown Import and export users and customers »

5 CVE

Critique 1 Élevée 2 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Import and export users and customers » ✕
  1. CVE-2026-92541 7.2 Élevée

    Unknown Import and export users and customers

    The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

  2. CVE-2026-92540 7.2 Élevée

    Unknown Import and export users and customers

    The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

  3. CVE-2026-16542 4.1 Moyenne

    Unknown Import and export users and customers

    The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

  4. CVE-2026-16534 9.1 Critique

    Unknown Import and export users and customers

    The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

  5. CVE-2025-15673 4.9 Moyenne

    Unknown Import and export users and customers

    The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.