CVE-2023-6583
Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality
CVSS Score
6.6
EPSS Score
0.0%
EPSS Percentile
0th
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.
| CWE | CWE-98 |
| Vendor | carazo |
| Product | import and export users and customers |
| Published | Jan 11, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for carazo import and export users and customers
Be the first to know when new medium vulnerabilities affecting carazo import and export users and customers are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
carazo / Import and export users and customers
0 ≤ 1.24.2
References
Credits
Gergely Kis