CVE-2026-15026
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-7641
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
+ 21 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2024-1050
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.26.6 |
Falta de control de autorización |
Media
4,3
|
< 1.26.6
|
1.26.6 |
2024-05-03 |
✓ corregido en la última versión
|
|
CVE-2024-32817
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.26.3 |
Deserialización de datos no confiables |
Media
4,4
|
< 1.26.3
|
1.26.3 |
2024-04-22 |
✓ corregido en la última versión
|
|
CVE-2024-22151
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.24.7 |
Falta de control de autorización |
Media
5,3
|
< 1.24.7
|
1.24.7 |
2024-01-16 |
✓ corregido en la última versión
|
|
CVE-2023-6624
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.24.4 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 1.24.4
|
1.24.4 |
2023-12-11 |
✓ corregido en la última versión
|
|
CVE-2023-6583
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.24.3 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Alta
7,2
|
< 1.24.3
|
1.24.3 |
2023-12-08 |
✓ corregido en la última versión
|
|
CVE-2022-3558
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.20.5 |
Neutralización incorrecta de elementos de fórmula en un archivo CSV (CSV Injection) |
Alta
8,0
|
< 1.20.5
|
1.20.5 |
2022-10-17 |
✓ corregido en la última versión
|
|
CVE-2022-1255
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.19.2.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 1.19.2.1
|
1.19.2.1 |
2022-04-11 |
✓ corregido en la última versión
|
|
CVE-2020-22277
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.16.3.6 |
Neutralización incorrecta de elementos de fórmula en un archivo CSV (CSV Injection) |
Alta
8,0
|
< 1.16.3.6
|
1.16.3.6 |
2020-11-04 |
✓ corregido en la última versión
|
|
—
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1 |
— |
Desconocido
|
< 1.15.0.1
|
1.15.0.1 |
2020-01-06 |
✓ corregido en la última versión
|
|
—
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1 |
— |
Desconocido
|
< 1.15.0.1
|
1.15.0.1 |
2020-01-01 |
✓ corregido en la última versión
|
|
—
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.14.2.2 |
— |
Desconocido
|
< 1.14.2.2
|
1.14.2.2 |
2019-06-26 |
✓ corregido en la última versión
|
|
CVE-2019-14683
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.14.2.2 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
5,7
|
< 1.14.2.2
|
1.14.2.2 |
2019-06-22 |
✓ corregido en la última versión
|
|
CVE-2019-15327
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.14.1.3 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.14.1.3
|
1.14.1.3 |
2019-06-20 |
✓ corregido en la última versión
|
|
CVE-2019-15326
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.14.2.2 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Alta
7,5
|
< 1.14.2.2
|
1.14.2.2 |
2019-06-20 |
✓ corregido en la última versión
|
|
CVE-2019-15328
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.14.0.3 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.14.0.3
|
1.14.0.3 |
2019-03-14 |
✓ corregido en la última versión
|
|
CVE-2019-15329
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.14.0.3 |
Falsificación de petición en sitios cruzados (CSRF) |
Alta
8,8
|
< 1.14.0.3
|
1.14.0.3 |
2019-03-14 |
✓ corregido en la última versión
|
|
CVE-2018-20101
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.12.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.12.1
|
1.12.1 |
2018-12-11 |
✓ corregido en la última versión
|
|
—
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.9.5 |
— |
Desconocido
|
< 1.9.5
|
1.9.5 |
2016-09-02 |
✓ corregido en la última versión
|
|
—
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.9.5 |
— |
Desconocido
|
< 1.9.5
|
1.9.5 |
2016-09-02 |
✓ corregido en la última versión
|
|
CVE-2026-3629
|
Import and export users and customers [import-users-from-csv-with-meta] < 2.0 |
— |
Desconocido
|
< 2.0
|
2.0 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1 |
— |
Desconocido
|
< 1.15.0.1
|
1.15.0.1 |
— |
✓ corregido en la última versión
|
CVE-2024-1050
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-32817
The Import and export users and customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.26.2 via deserialization of untrusted input in the import.php file. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-22151
Update the WordPress Import and export users and customers plugin to the latest available version (at least 1.24.7).
emad discovered and reported this Broken Access Control vulnerability in WordPress Import and export users and customers Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 1.24.7.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-6624
Update the WordPress Import and export users and customers plugin to the latest available version (at least 1.24.4).
Rafshanzani Suhada discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Import and export users and customers Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.24.4.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-6583
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2022-3558
The Import and export users and customers plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.20.4. This allows subscriber-level attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2022-1255
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2020-22277
The plugin did not validate or sanitise user data, such as first and last names from the profile, leading to a CSV injection when the data is exported by an administrator.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1
Unauthorised Authenticated Users Export vulnerability found in WordPress Import Users From CSV with Meta plugin (version 1.15).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Data Exposure in version 1.15 via the export_users_csv function. This can allow authenticated attackers to export user information even if they do not have account creation privileges. The function was introduced in this version and fixed in subsequent versions.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Import and export users and customers [import-users-from-csv-with-meta] < 1.14.2.2
Cross-Site Request Forgery (CSRF) vulnerability found in WordPress Import users from CSV with meta plugin (versions <= 1.14.1.3).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2019-14683
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2019-15327
The Import and export users and customers WordPress plugin was affected by a XSS security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
CVE-2019-15326
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2019-15328
The Import and export users and customers WordPress plugin was affected by a XSS and CSRF security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
CVE-2019-15329
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2018-20101
Cross-Site Scripting (XSS) vulnerability discovered by Slawek Zytko in WordPress Import users from CSV with meta plugin (versions <= 1.12).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Import and export users and customers [import-users-from-csv-with-meta] < 1.9.5
In version 1.9.4.6, WordPress Import users from CSV with meta plugin, the function acui_delete_attachment() doesn't check for the current user capabilities so any logged in user can delete media files.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Import and export users and customers [import-users-from-csv-with-meta] < 1.9.5
In the function acui_fileupload_process() there's no check for a nonce so a CSRF vulnerability exists.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2026-3629
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields in profile" setting is enabled and a CSV with a wp_capabilities column header has been previously imported.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Import and export users and customers [import-users-from-csv-with-meta] < 1.15.0.1
The export_users_csv function, registered as an authenticated AJAX call and allowing to export users, was missing the authorisation/capability check. CSRF check was in place, reducing the severity of the issue.
Only version 1.15 seems to be affected as the export functionality is a new feature introduced by it.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén Import Users From Csv With Meta actualizado — 2.4.1 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.