CVE-2026-87836

Name of the Vulnerable Software and Affected Versions Comments Import & Export versions prior to 2.5.4

Description The plugin fails to restrict the comment export feature to users with comment moderation privileges and does not limit the export to content owned by the requesting user. This allows users with the Author role or higher to retrieve all comments on the site, including commenter email addresses, IP addresses, unapproved comment content, and comment meta.

Recommendations Update to version 2.5.4 or later.