CVE-2025-15673: WordPress Plugin Path Traversal Flaw

CVE-2025-15673 Overview

CVE-2025-15673 affects the Import and export users and customers WordPress plugin in versions prior to 2.4.3. The plugin fails to restrict the file path parameter used during CSV import operations. High-privileged users can supply arbitrary paths and force the plugin to read and display files stored anywhere on the server. This is a path traversal weakness classified as [CWE-22].

The flaw does not affect integrity or availability, but it exposes sensitive server-side files including configuration data, credentials, and other WordPress internals. Attackers who already hold administrative or equivalent privileges can weaponize the import feature to exfiltrate content that should remain inaccessible through the plugin interface.

Critical Impact
Authenticated high-privileged users can read arbitrary files on the WordPress server, including wp-config.php and other sensitive configuration files, through the plugin's CSV import functionality.

Affected Products

Import and export users and customers WordPress plugin versions before 2.4.3
WordPress installations with the vulnerable plugin activated
Multisite WordPress deployments running the affected plugin

Discovery Timeline

2026-08-03 - CVE-2025-15673 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2025-15673

Vulnerability Analysis

The plugin exposes a CSV import routine that accepts a file path parameter from the requesting user. The routine reads the file at that path and displays its contents back to the user during the import preview or processing stage. Because the path is not restricted to an allowed directory or validated against a whitelist, an attacker can supply traversal sequences or absolute paths to reach files outside the plugin's intended scope.

The vulnerability requires high privileges to exploit. This limits opportunistic attacks but does not prevent abuse by compromised administrator accounts, malicious insiders, or attackers who have already escalated privileges through another flaw. The reflected file contents make this a direct arbitrary file read primitive rather than a blind disclosure.

Root Cause

The root cause is missing path canonicalization and validation on the CSV file parameter. The plugin trusts the supplied path and passes it to a file read operation without confirming that the resolved path resides within an authorized directory such as the WordPress uploads folder. This is a classic instance of [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An authenticated user with administrative privileges triggers the CSV import feature and substitutes a path pointing to a sensitive file such as /var/www/html/wp-config.php or /etc/passwd. The plugin reads the target file and renders its contents in the import preview response. Refer to the WPScan Vulnerability Report for the technical write-up.

// No verified proof-of-concept code has been published.
// See the WPScan advisory for exploitation details.

Detection Methods for CVE-2025-15673

Indicators of Compromise

Access log entries showing POST requests to the plugin's import endpoint containing path traversal sequences such as ../ or absolute paths to system files
Unexpected read access to wp-config.php, /etc/passwd, or other sensitive files by the PHP process associated with WordPress
Administrator user sessions initiating CSV imports with file parameters outside the standard uploads directory

Detection Strategies

Inspect WordPress and web server logs for import requests that reference paths outside wp-content/uploads/
Correlate administrator authentication events with subsequent import actions to identify anomalous file read patterns
Deploy file integrity monitoring on sensitive WordPress files to alert when the web server process reads them outside expected workflows

Monitoring Recommendations

Enable verbose logging on the plugin's import handler and forward events to a centralized logging platform
Alert on any read of wp-config.php by the PHP-FPM or Apache worker process outside of application startup
Track administrative user activity for lateral file access that does not match documented business workflows

How to Mitigate CVE-2025-15673

Immediate Actions Required

Update the Import and export users and customers plugin to version 2.4.3 or later on all WordPress sites
Audit administrator and equivalent high-privilege accounts and revoke access for users who no longer require it
Review recent CSV import activity for evidence of arbitrary file read attempts and rotate any credentials that may have been exposed

Patch Information

The vendor addressed the vulnerability in version 2.4.3 of the plugin. Administrators should apply the update through the WordPress plugin management interface or by deploying the updated package through their configuration management pipeline. Consult the WPScan Vulnerability Report for confirmation of the fixed version.

Workarounds

Deactivate the plugin until the patched version can be installed if immediate updates are not feasible
Restrict administrator access to the WordPress dashboard through IP allowlisting or a reverse proxy
Apply web application firewall rules that block requests to the plugin's import endpoint containing traversal sequences or absolute paths

bash

# Example WAF rule concept blocking traversal in the import parameter
# ModSecurity-style pseudo rule
SecRule ARGS:file "@rx (\.\./|^/)" \
  "id:1015673,phase:2,deny,status:403,\
   msg:'Blocked path traversal in plugin import parameter'"