CVE-2025-1973

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1973", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-04T21:06:31.898Z", "datePublished": "2025-03-22T11:23:31.986Z", "dateUpdated": "2026-04-08T16:36:41.274Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:41.274Z"}, "affected": [{"vendor": "webtoffee", "product": "Export and Import Users and Customers", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information."}], "title": "Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13b7a2e4-59f4-4d61-a165-a830ccfb696a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/history/history.php#L751"}, {"url": "https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3259688/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Hay Mizrachi"}], "timeline": [{"time": "2025-03-21T23:19:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-24T17:36:14.443836Z", "id": "CVE-2025-1973", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T17:36:21.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-24T17:36:14.443836Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T17:36:18.048Z"}}], "cna": {"title": "Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function", "credits": [{"lang": "en", "type": "finder", "value": "Hay Mizrachi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "webtoffee", "product": "Export and Import Users and Customers", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-21T23:19:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13b7a2e4-59f4-4d61-a165-a830ccfb696a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/history/history.php#L751"}, {"url": "https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3259688/"}], "descriptions": [{"lang": "en", "value": "The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:41.274Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1973", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:41.274Z", "dateReserved": "2025-03-04T21:06:31.898Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-22T11:23:31.986Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Export and Import Users and Customers", "vendor": "webtoffee", "versions": [{"lessThanOrEqual": "2.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webtoffee:import_export_wordpress_users:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "2F5A53F0-76A9-4CFE-9557-F72DAAEABCAF", "versionEndExcluding": "2.6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information."}, {"lang": "es", "value": "El complemento Export and Import Users and Customers para WordPress es vulnerable a Path Traversal en todas las versiones hasta la 2.6.2 incluida, a trav\u00e9s de la funci\u00f3n download_file(). Esto permite a atacantes autenticados, con acceso de administrador o superior, leer el contenido de archivos de registro arbitrarios en el servidor, que pueden contener informaci\u00f3n confidencial."}], "id": "CVE-2025-1973", "lastModified": "2026-06-17T08:40:27.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1973", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-24T17:36:14.443836Z", "version": "2.0.3"}}]}, "published": "2025-03-22T12:15:26.653", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/history/history.php#L751"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3259688/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13b7a2e4-59f4-4d61-a165-a830ccfb696a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:43:19.410344+00:00", "value": {"mitigation_remediation": ["Upgrade the Export and Import Users and Customers plugin to version 2.6.3 or later.", "If an update is not immediately feasible, remove or disable the download_file() functionality or restrict it so that it cannot access directories outside the intended export folder.", "Restrict the number of Administrator\u2011level accounts and enforce least\u2011privilege principles so that only essential personnel retain high\u2011level access."], "summary": {"action": "Update Plugin", "impact": "Authenticated Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the Webtoffee Export and Import Users and Customers plugin installed on version 2.6.2 or earlier. The vulnerability is specifically tied to the plugin provided by Webtoffee and is relevant to WordPress installations that include this plugin.", "description_and_impact": "The Export and Import Users and Customers plugin, used within WordPress, contains a directory traversal flaw in the download_file() function. This weakness (CWE\u201122) allows an attacker who has authenticated Administrator or higher privileges to read the contents of any file on the server by crafting a path traversal request. The plugin could expose log files that may hold sensitive data, therefore compromising confidentiality of those files.", "risk_and_exploitability": "The CVSS score for this issue is 4.9, indicating moderate severity. The EPSS score of less than 1% reflects a very low but non\u2011zero probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authorized Administrator or higher account, meaning the danger arises from credential compromise or mis\u2011assigned privileges rather than from direct unauthenticated access."}}}}, "created": "2026-04-22T17:45:22.926933+00:00", "updated": "2026-04-22T17:45:22.926949+00:00", "vendors": []}