CVE-2026-14925: Import WP Information Disclosure Flaw

CVE-2026-14925 Overview

The Import WP WordPress plugin before version 2.14.23 contains a missing authorization vulnerability in one of its export-file download handlers. Unauthenticated attackers can download export files generated by administrators without any credential check. These exports may include user personal data such as email addresses, login names, and role assignments. Successful exploitation requires an unconsumed export to already exist on the site and the attacker to obtain a low-entropy, time-based download key. The issue is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can retrieve WordPress user personal data, including emails, usernames, and roles, enabling downstream phishing and credential-stuffing campaigns.

Affected Products

Import WP WordPress plugin versions prior to 2.14.23
WordPress installations with the plugin installed and an unconsumed export file present
Sites where the export download key remains valid within its time-based validity window

Discovery Timeline

2026-08-12 - CVE-2026-14925 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-14925

Vulnerability Analysis

The vulnerability resides in an export-file download handler that fails to perform an authorization check before serving the requested file. The plugin generates export archives when an administrator triggers an export operation. These archives can contain personally identifiable information (PII) drawn from the WordPress users table, including email addresses, login names, and assigned roles. Because the handler does not verify the caller's identity or capability, any unauthenticated HTTP client that supplies a valid download key receives the file. The download key itself is derived from a low-entropy, time-based value, which reduces the effective search space for an attacker attempting to guess or predict valid keys.

Root Cause

The root cause is a missing authorization control on the download endpoint. WordPress plugins are expected to gate privileged operations with current_user_can() capability checks or nonce verification through check_admin_referer() or wp_verify_nonce(). The vulnerable handler in Import WP omits these checks, relying solely on possession of a predictable download key. This aligns with [CWE-200] because sensitive information is exposed to actors who should not have access to it.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. The attacker must satisfy two preconditions: an unconsumed export file must exist on the target site, and the attacker must obtain or derive a valid download key. Because the key is time-based and low-entropy, an attacker who knows the approximate export timestamp can brute-force the key space within a practical window. Once a valid key is found, the attacker issues an HTTP GET request to the export download handler and receives the export file. The exposed data supports follow-on attacks such as targeted phishing against administrators, credential stuffing against harvested email addresses, and reconnaissance of privileged accounts.

See the WPScan Vulnerability Report for the vendor-tracked entry.

Detection Methods for CVE-2026-14925

Indicators of Compromise

Repeated HTTP GET requests to Import WP export download endpoints from a single client, indicating key-guessing activity
Successful 200 OK responses to unauthenticated requests targeting export file handlers
Access log entries showing export downloads from IP addresses that never authenticated to wp-login.php
Presence of stale or unconsumed export files in the plugin's export storage directory

Detection Strategies

Review web server access logs for high-volume requests to Import WP handler URLs containing download or export parameters
Correlate export download events with the absence of an authenticated administrator session at the same time window
Alert on requests to plugin endpoints where the User-Agent, referrer, or IP does not match known administrator activity

Monitoring Recommendations

Ingest WordPress access logs and PHP error logs into a centralized log platform for retention and query
Track the plugin version installed across all managed WordPress sites and flag versions below 2.14.23
Monitor filesystem changes to the Import WP export directory and alert on file access outside expected administrator windows

How to Mitigate CVE-2026-14925

Immediate Actions Required

Upgrade the Import WP plugin to version 2.14.23 or later on all WordPress installations
Delete any unconsumed export files currently stored by the plugin to remove attacker-accessible artifacts
Rotate credentials for any administrator accounts whose email addresses or login names may have been exposed
Audit recent web server access logs for unauthenticated requests to Import WP export handlers

Patch Information

The vendor addressed the vulnerability in Import WP version 2.14.23. Site operators should apply the update through the WordPress plugin management interface or via WP-CLI. Refer to the WPScan Vulnerability Report for the fix reference.

Workarounds

Disable the Import WP plugin until the patched version can be installed
Restrict access to /wp-content/plugins/import-wp/ and export storage paths via web server rules or a web application firewall
Remove all previously generated export files from the plugin's storage directory to eliminate the exploitation precondition

bash

# Update Import WP to the patched version via WP-CLI
wp plugin update import-wp --version=2.14.23

# Verify the installed version
wp plugin get import-wp --field=version

# Remove stale export files (adjust path to your installation)
find wp-content/uploads/import-wp/exports -type f -mtime +0 -delete