CVE-2023-6558 – The Export and Import Users and Customers WordP... (How to Fix)

Q: What is the severity of CVE-2023-6558?

CVE-2023-6558 has a CVSS score of 7.2 (HIGH). The Export and Import Users and Customers WordPress plugin up to version 2.4.8 has insufficient file type validation in the upload_import_file function, allowing authenticated attackers with shop manager or higher privileges to upload arbitrary files. This can lead to remote code execution on vulnerable WordPress sites.

📋 TL;DR

The Export and Import Users and Customers WordPress plugin up to version 2.4.8 has insufficient file type validation in the upload_import_file function, allowing authenticated attackers with shop manager or higher privileges to upload arbitrary files. This can lead to remote code execution on vulnerable WordPress sites.

💻 Affected Systems

Products:

Export and Import Users and Customers WordPress plugin

Versions: Up to and including 2.4.8

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with shop manager or higher privileges. WordPress sites with this plugin installed are vulnerable.

📦 What is this software?

Import Export Wordpress Users by Webtoffee

View all CVEs affecting Import Export Wordpress Users →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise via remote code execution, allowing attackers to install backdoors, steal data, deface websites, or pivot to other systems.

🟠

Likely Case

Website defacement, data theft, or installation of cryptocurrency miners or malware on vulnerable WordPress installations.

🟢

If Mitigated

Limited impact if proper file upload restrictions and user privilege controls are in place, though the vulnerability still exists.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.9

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3008454/users-customers-import-export-for-wp-woocommerce

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Export and Import Users and Customers' plugin. 4. Click 'Update Now' if available, or manually update to version 2.4.9+. 5. Verify the plugin version after update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the plugin until patched

wp plugin deactivate users-customers-import-export-for-wp-woocommerce

Restrict file uploads via .htaccess

linux

Block PHP file execution in upload directories

Add to .htaccess in uploads directory: <FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

🧯 If You Can't Patch

Remove shop manager privileges from untrusted users
Implement web application firewall rules to block suspicious file uploads

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for 'Export and Import Users and Customers' version 2.4.8 or lower

Check Version:

wp plugin get users-customers-import-export-for-wp-woocommerce --field=version

Verify Fix Applied:

Verify plugin version is 2.4.9 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual file uploads to /wp-content/uploads/ directory
POST requests to /wp-admin/admin-ajax.php with action=upload_import_file
PHP file execution from upload directories

Network Indicators:

HTTP POST requests with file uploads to WordPress admin endpoints
Unusual outbound connections from web server after file upload

SIEM Query:

source="web_server_logs" AND (uri="/wp-admin/admin-ajax.php" AND parameters.action="upload_import_file")

📊 Metadata

CVE ID: CVE-2023-6558

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: January 11, 2024

Last Updated: June 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-6558, you might also want to check these: