{
 "id": "WPSEC-2026-3009",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3009/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3009/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3009/index.md",
 "title": "Import and export users and customers <= 2.5.13 - Unauthenticated Sensitive Information Exposure via Predictable User Export File Names",
 "description": "The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure via the batch user export feature in all versions up to, and including, 2.5.13. This is due to export CSV files being written to the publicly accessible root of the uploads directory with predictable, time-based (uniqid) file names and no protection or reliable cleanup. This makes it possible for unauthenticated attackers to guess the URL of an export file generated by an administrator and download it, exposing user emails, metadata and password hashes.",
 "plugin": {
  "slug": "import-users-from-csv-with-meta",
  "name": "Import and export users and customers",
  "full_name": "Import and export users and customers",
  "wordpress_org": "https://wordpress.org/plugins/import-users-from-csv-with-meta/",
  "advisories_url": "https://wpsec.com/vuln/plugin/import-users-from-csv-with-meta/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/import-users-from-csv-with-meta"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.27.13",
    "from_inclusive": true,
    "to": "2.5.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.27.13 before 2.5.14"
  ]
 },
 "introduced_in": "1.27.13",
 "fixed_in": "2.5.14",
 "remediation": "Update to 2.5.14 or later.",
 "fix_released": "2026-11-11T22:04:37+00:00",
 "published": "2026-11-12T22:43:10+00:00",
 "updated": "2026-11-12T17:10:34.020484+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3009/",
  "https://plugins.svn.wordpress.org/import-users-from-csv-with-meta/tags/2.5.14/",
  "https://wordpress.org/plugins/import-users-from-csv-with-meta/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/import-users-from-csv-with-meta",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}