CVE-2025-15673 WordPress.org CVE debrief

Who should care

WordPress administrators and security teams responsible for high-privileged user accounts, as well as IT teams managing WordPress installations, should be aware of this vulnerability and take immediate action to assess exposure and prioritize remediation. Additionally, security teams monitoring for potential exploitation attempts and verifying inventory of affected WordPress installations should also be notified.

Why it matters

CVE-2025-15673 allows high-privileged users to read arbitrary files on the server during a CSV import in the Import and export users and customers WordPress plugin before version 2.4.3. WordPress administrators and security teams should assess exposure, prioritize remediation, and monitor for potential exploitation attempts.

• Potential unauthorized file access by high-privileged users
• Need to verify inventory of affected WordPress installations
• Remediation priority for vulnerable plugin versions
• Monitoring for potential exploitation attempts

Technical summary

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server. This vulnerability is due to insufficient input validation and sanitization of file paths, enabling attackers to access sensitive files and potentially sensitive information. The plugin's functionality allows for the import and export of user and customer data, but it does not properly validate the files being read or written.

Defensive priority

Assess exposure and prioritize remediation for high-privileged users

Recommended defensive actions

• Assess exposure of high-privileged users to the vulnerable plugin
• Prioritize remediation of the vulnerable plugin
• Verify inventory of WordPress installations with the plugin installed
• Monitor for potential exploitation attempts

Evidence notes

The vulnerability allows high-privileged users to read arbitrary files on the server during a CSV import. The affected plugin is Import and export users and customers before version 2.4.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.