CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.2.
Explanation of Vulnerability in Simple Terms
The Import and export users and customers plugin for WordPress contains a deserialization vulnerability in versions up to 1.26.2. An authenticated administrator can supply malicious serialized data that the plugin processes without proper validation, potentially leading to information disclosure or data modification. The vulnerability requires high-level privileges and complex attack conditions to exploit.
What an attacker can do
Read or modify site data by submitting malicious serialized input during user/customer import operations.
Potential impact on your site
A compromised admin account could leak user data or alter customer records through the import feature.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site and manually trigger the import function.
Key dates
External resources
Related vulnerabilities
