PT-2026-95914 · WordPress · Export/Import Users/Customers

Binesh Madharapu

·

CVE-2026-16542

·

Published

2026-09-20

·

Updated

2026-09-20

CVSS v3.1

4.1

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Import and export users and customers WordPress plugin versions prior to 2.4.5
Description High-privileged users can perform Server-Side Request Forgery (SSRF) attacks during a CSV import. This occurs because the plugin fails to validate a user-supplied URL before the server requests it.
Recommendations Update the plugin to version 2.4.5 or later.

Exploit

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-16542

Affected Products

Export/Import Users/Customers