CVE-2025-1973 – This vulnerability in the Export and Import Use... (How to Fix)

Q: What is the severity of CVE-2025-1973?

CVE-2025-1973 has a CVSS score of 4.9 (MEDIUM). This vulnerability in the Export and Import Users and Customers WordPress plugin allows authenticated attackers with Administrator privileges to perform path traversal attacks. By exploiting the download_file() function, attackers can read arbitrary log files on the server, potentially exposing sensitive information. All WordPress sites using this plugin up to version 2.6.2 are affected.

📋 TL;DR

This vulnerability in the Export and Import Users and Customers WordPress plugin allows authenticated attackers with Administrator privileges to perform path traversal attacks. By exploiting the download_file() function, attackers can read arbitrary log files on the server, potentially exposing sensitive information. All WordPress sites using this plugin up to version 2.6.2 are affected.

💻 Affected Systems

Products:

Export and Import Users and Customers WordPress plugin

Versions: All versions up to and including 2.6.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress administrator or higher privileges. Plugin must be installed and active.

📦 What is this software?

Import Export Wordpress Users by Webtoffee

View all CVEs affecting Import Export Wordpress Users →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Administrator-level attackers could read sensitive server logs containing database credentials, API keys, user data, or other confidential information, leading to full system compromise.

🟠

Likely Case

Malicious administrators or compromised admin accounts reading log files to gather sensitive information for further attacks or data exfiltration.

🟢

If Mitigated

With proper access controls and monitoring, impact is limited to authorized administrators who shouldn't have access to arbitrary server files.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires administrator credentials but is technically simple once authenticated.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.6.3

Vendor Advisory: https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Export and Import Users and Customers' plugin. 4. Click 'Update Now' if available, or download version 2.6.3+ from WordPress repository. 5. Activate updated plugin.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the plugin until patched

wp plugin deactivate users-customers-import-export-for-wp-woocommerce

Restrict admin access

all

Limit administrator accounts to trusted personnel only

🧯 If You Can't Patch

Implement strict access controls and monitor administrator account activity
Restrict file system permissions and implement web application firewall rules

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 2.6.2 or lower, you are vulnerable.

Check Version:

wp plugin get users-customers-import-export-for-wp-woocommerce --field=version

Verify Fix Applied:

Verify plugin version is 2.6.3 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns in web server logs, particularly requests to plugin's history.php with file parameter manipulation

Network Indicators:

HTTP requests to /wp-content/plugins/users-customers-import-export-for-wp-woocommerce/admin/modules/history/history.php with suspicious file parameters

SIEM Query:

source="web_server" AND uri="*history.php*" AND (param="*../*" OR param="*..\\*" OR param="*absolute/path*")

📊 Metadata

CVE ID: CVE-2025-1973

CVSS v3 Score: 4.9 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-22

EPSS Score: 0.32% exploit probability (54.2th percentile)

Published: March 22, 2025

Last Updated: July 9, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-1973, you might also want to check these: