{
 "id": "WPSEC-2026-3010",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3010/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3010/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3010/index.md",
 "title": "Import and export users and customers <= 2.5.13 - Unauthenticated Sensitive Information Exposure via Predictable Import CSV File Names",
 "description": "The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure via the manual user import feature in all versions up to, and including, 2.5.13. This is due to uploaded import CSV files being stored in the publicly accessible root of the uploads directory with predictable, time-based (uniqid) file names, and being left behind when an import is not finished. This makes it possible for unauthenticated attackers to guess the URL of an uploaded import file and download it, exposing user data that may include plaintext passwords.",
 "plugin": {
  "slug": "import-users-from-csv-with-meta",
  "name": "Import and export users and customers",
  "full_name": "Import and export users and customers",
  "wordpress_org": "https://wordpress.org/plugins/import-users-from-csv-with-meta/",
  "advisories_url": "https://wpsec.com/vuln/plugin/import-users-from-csv-with-meta/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/import-users-from-csv-with-meta"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0",
    "from_inclusive": true,
    "to": "2.5.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0 before 2.5.14"
  ]
 },
 "introduced_in": "2.0",
 "fixed_in": "2.5.14",
 "remediation": "Update to 2.5.14 or later.",
 "fix_released": "2026-11-11T22:04:37+00:00",
 "published": "2026-11-12T22:43:10+00:00",
 "updated": "2026-11-12T17:10:34.020484+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3010/",
  "https://plugins.svn.wordpress.org/import-users-from-csv-with-meta/tags/2.5.14/",
  "https://wordpress.org/plugins/import-users-from-csv-with-meta/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/import-users-from-csv-with-meta",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}