Export and Import Users and Customers vulnerabilities

5 known vulnerabilities in Export and Import Users and Customers from WebToffee. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Export and Import Users and Customers: Improper Encoding or Escaping of Output

  CVE-2026-104368Oct 30, 2026WebToffee

  The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mism

• 7.2 High severity

  Export and Import Users and Customers: Deserialization of Untrusted Data

  CVE-2025-1971Mar 22, 2025WebToffee

  The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated att

• 7.6 High severity

  Export and Import Users and Customers: Server-Side Request Forgery

  CVE-2025-1970Mar 22, 2025WebToffee

  The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-lev

• 7.2 High severity

  Export and Import Users and Customers: Unrestricted Upload of File with Dangerous Type

  CVE-2023-6558Jan 11, 2024WebToffeeEPSS 1.37%

  The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticat

• 7.2 High severity

  Export and Import Users and Customers: Incorrect Authorization

  CVE-2023-3459Jul 18, 2023WebToffee

  The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This mak