sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total20
Critical0
High10
Medium10
Reset
Showing 1-20 of 20 records
Threat Entry Updated 2026-11-04

Import Users From Csv With Meta - Security Vulnerability (CVE-2026-120554)

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and…

PLUGIN Import Users From Csv With Meta

CVE-2026-120554

HIGH CVSS 8.8 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-09-24

Import Users From Csv With Meta - Security Vulnerability (CVE-2026-86583)

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname…

PLUGIN Import Users From Csv With Meta

CVE-2026-86583

HIGH CVSS 8.8 2026-09-23
Open Full Technical Breakdown
Threat Entry Updated 2026-07-10

Import Users From Csv With Meta - Information Disclosure (CVE-2026-15026)

The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template…

PLUGIN Import Users From Csv With Meta

CVE-2026-15026

MEDIUM CVSS 4.3 2026-07-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Import Users From Csv With Meta - Privilege Escalation (CVE-2026-7641)

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated…

PLUGIN Import Users From Csv With Meta

CVE-2026-7641

HIGH CVSS 8.8 2026-05-02
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Import Users From Csv With Meta - Privilege Escalation (CVE-2026-3629)

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields…

PLUGIN Import Users From Csv With Meta

CVE-2026-3629

HIGH CVSS 8.1 2026-03-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Import Users From Csv With Meta - Information Disclosure (CVE-2025-24689)

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through

PLUGIN Import Users From Csv With Meta

CVE-2025-24689

MEDIUM CVSS 5.9 2025-01-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Import Users From Csv With Meta - Cross-Site Scripting (XSS) (CVE-2024-50413)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through

PLUGIN Import Users From Csv With Meta

CVE-2024-50413

MEDIUM CVSS 5.9 2024-10-29
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Import Users From Csv With Meta - Broken Access Control (CVE-2024-1050)

The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.

PLUGIN Import Users From Csv With Meta

CVE-2024-1050

MEDIUM CVSS 4.3 2024-05-04
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.