CVE-2026-87836: WordPress Comments Import Export Plugin Flaw

CVE-2026-87836 Overview

CVE-2026-87836 is an information disclosure vulnerability in the Comments Import & Export WordPress plugin versions before 2.5.4. The plugin fails to restrict its comment export functionality to users with the moderate_comments capability. It also does not scope exported data to content owned by the requesting user.

Authenticated users with the Author role or higher can export every comment on the site. Exported data includes commenter email addresses, IP addresses, unapproved comment content, and comment metadata. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privileged authenticated users can harvest personally identifiable information (PII) belonging to every commenter on an affected WordPress site.

Affected Products

Comments Import & Export WordPress plugin versions prior to 2.5.4
WordPress sites permitting user registration at Author role or above
Multi-author WordPress deployments using the plugin for comment management

Discovery Timeline

2026-09-17 - CVE-2026-87836 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87836

Vulnerability Analysis

The Comments Import & Export plugin exposes an export endpoint that returns the full comment dataset for a WordPress installation. The endpoint performs an authentication check but omits a capability check for moderate_comments. Any authenticated user meeting a minimal role requirement can invoke the export.

The returned dataset is not filtered by post ownership. An Author who legitimately manages only their own posts receives comments belonging to every post on the site. This includes sensitive fields normally reserved for administrators and comment moderators.

Exposed fields include commenter email addresses, IP addresses stored with each comment, unapproved comment bodies pending moderation, and arbitrary comment meta values. Attackers can weaponize this data for spam campaigns, targeted phishing, or de-anonymization of pseudonymous commenters.

Root Cause

The root cause is missing authorization enforcement in the export handler. The plugin verifies that a request originates from an authenticated user but does not verify the user holds the moderate_comments capability. It also lacks per-user scoping logic that would restrict exports to comments on posts authored by the requesting user.

Attack Vector

Exploitation requires a valid account with Author privileges or higher. An attacker registers or compromises such an account, authenticates to the WordPress admin interface, and invokes the plugin's export function. The server returns a file containing every comment record on the site. No user interaction from an administrator is required. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-87836

Indicators of Compromise

Unexpected requests to the plugin's export endpoint originating from Author, Editor, or Contributor-level accounts
Web server access logs showing large-volume responses from the Comments Import & Export plugin URL to non-administrative sessions
Newly registered Author accounts followed shortly by export activity

Detection Strategies

Audit WordPress access logs for HTTP requests targeting the Comments Import & Export plugin's admin AJAX or admin-post handlers
Correlate the WordPress user role of the requesting session against the endpoint invoked; flag exports issued by non-administrator roles
Monitor for outbound transfers of CSV or similar structured files from /wp-admin/ paths to unusual client IPs

Monitoring Recommendations

Enable WordPress audit logging plugins to record export actions and the invoking user
Alert on any creation of Author or higher accounts outside expected provisioning workflows
Review comment export activity as part of periodic privileged-action reviews

How to Mitigate CVE-2026-87836

Immediate Actions Required

Upgrade the Comments Import & Export plugin to version 2.5.4 or later
Review the list of users holding Author role or above and remove accounts that no longer require access
Disable open user registration or restrict the default registration role to Subscriber

Patch Information

The vendor addressed the vulnerability in Comments Import & Export version 2.5.4. The fix introduces a capability check requiring moderate_comments before the export handler executes. Administrators should apply the update through the WordPress plugin manager or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Comments Import & Export plugin until the patched version is installed
Restrict access to /wp-admin/ paths by IP address using web server or WAF rules
Temporarily downgrade non-administrator users who require only content authoring privileges

bash

# Update the plugin using WP-CLI
wp plugin update import-export-comments --version=2.5.4

# Verify installed version
wp plugin get import-export-comments --field=version