WordPress plugin

Import and export users and customers security & vulnerabilities

Q: Does Import and export users and customers have known vulnerabilities?

Yes. VulnCrest Radar lists 35 known vulnerabilities in Import and export users and customers: 13 high, 22 medium. None are known to affect version null.

Q: How do I check which version of Import and export users and customers I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Import and export users and customers vulnerability?

CVE-2026-120554, published Nov 3, 2026: Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save. Severity: High (CVSS 8.8).

Q: Is any Import and export users and customers vulnerability listed in CISA KEV?

No. None of the known Import and export users and customers vulnerabilities is currently listed in the CISA KEV catalog.

import-users-from-csv-with-meta— active installsLast vulnerability Nov 3, 2026

No known unpatched vulnerabilities in the latest version

All 35 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

35Known vulnerabilities

Critical0
High13
Medium22
Low0

Vulnerabilities per year

All Import and export users and customers vulnerabilities

Import and export users and customers vulnerabilities
Severity	Vulnerability	CVE	Published
High8.8	Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save ≤2.5.11Update to 2.5.12	CVE-2026-120554	Nov 03
High8.8	Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields ≤2.4.17Update to 2.4.18	CVE-2026-86583	Sep 23
High7.2	Authenticated (Admin+) Privilege Escalation ≤2.5.1Update to 2.5.2	CVE-2026-92541	Sep 18
High7.2	Authenticated (Admin+) Privilege Escalation ≤2.5.1Update to 2.5.2	CVE-2026-92540	Sep 18
High7.2	Authenticated (Admin+) Privilege Escalation ≤2.4.1Update to 2.4.2	CVE-2026-16534	Jul 23
High8.8	Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields ≤2.0.8Update to 2.0.9	CVE-2026-7641	May 01
High8.1	Privilege Escalation to Administrator via save_extra_user_profile_fields ≤1.29.7Update to 2.0	CVE-2026-3629	Mar 21
High7.2	Authenticated (Admin+) PHP Object Injection ≤1.26.2Update to 1.26.3	CVE-2024-32817	Apr 22, 2024
High8.0	Authenticated (Subscriber+) CSV Injection ≤1.20.4Update to 1.20.5	CVE-2022-3558	Oct 17, 2022
High7.3	CSV injection via a customer's profile ≤1.16.3.5Update to 1.16.3.6	CVE-2020-22277	Nov 20, 2020
High7.7	Sensitive Data Exposure 1.15 – 1.15Update to 1.15.0.1	—	Jan 1, 2020
High7.5	Directory Traversal ≤1.14.2.1Update to 1.14.2.2	CVE-2019-15326	Jun 20, 2019
High8.8	Cross-Site Request Forgery <1.14.0.3Update to 1.14.0.3	CVE-2019-15329	Mar 14, 2019

High8.8
Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
≤2.5.11Update to 2.5.12
CVE-2026-120554Nov 03
High8.8
Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
≤2.4.17Update to 2.4.18
CVE-2026-86583Sep 23
High7.2
Authenticated (Admin+) Privilege Escalation
≤2.5.1Update to 2.5.2
CVE-2026-92541Sep 18
High7.2
Authenticated (Admin+) Privilege Escalation
≤2.5.1Update to 2.5.2
CVE-2026-92540Sep 18
High7.2
Authenticated (Admin+) Privilege Escalation
≤2.4.1Update to 2.4.2
CVE-2026-16534Jul 23
High8.8
Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
≤2.0.8Update to 2.0.9
CVE-2026-7641May 01
High8.1
Privilege Escalation to Administrator via save_extra_user_profile_fields
≤1.29.7Update to 2.0
CVE-2026-3629Mar 21
High7.2
Authenticated (Admin+) PHP Object Injection
≤1.26.2Update to 1.26.3
CVE-2024-32817Apr 22, 2024
High8.0
Authenticated (Subscriber+) CSV Injection
≤1.20.4Update to 1.20.5
CVE-2022-3558Oct 17, 2022
High7.3
CSV injection via a customer's profile
≤1.16.3.5Update to 1.16.3.6
CVE-2020-22277Nov 20, 2020
High7.7
Sensitive Data Exposure
1.15 – 1.15Update to 1.15.0.1
e46ff294-0be1-47c1-8c21-f6242c6f832aJan 1, 2020
High7.5
Directory Traversal
≤1.14.2.1Update to 1.14.2.2
CVE-2019-15326Jun 20, 2019
High8.8
Cross-Site Request Forgery
<1.14.0.3Update to 1.14.0.3
CVE-2019-15329Mar 14, 2019

Import and export users and customers: common questions

Does Import and export users and customers have known vulnerabilities?

Yes. VulnCrest Radar lists 35 known vulnerabilities in Import and export users and customers: 13 high, 22 medium. None are known to affect version null.

How do I check which version of Import and export users and customers I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Import and export users and customers vulnerability?

CVE-2026-120554, published Nov 3, 2026: Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save. Severity: High (CVSS 8.8).

Is any Import and export users and customers vulnerability listed in CISA KEV?

No. None of the known Import and export users and customers vulnerabilities is currently listed in the CISA KEV catalog.