Carazo vulnerabilities
We track 5 vulnerabilities in Carazo products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Carazo vulnerabilities
- 8.8 High severity
Import and export users and customers: Incorrect Authorization
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persis
- 8.8 High severity
Import and export users and customers: Incorrect Privilege Assignment
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells
- 8.8 High severity
Import and export users and customers: Improper Privilege Management
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts
- 8.1 High severity
Import and export users and customers: Improper Privilege Management
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be
- 7.2 High severity
Import and export users and customers: Improper Limitation of a Pathname to a Restricted Directory
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator acce