CVE-2025-1972: Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the adminlogpage() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1972?
CVE-2025-1972 is classified as a high severity vulnerability due to arbitrary file deletion risks.
How do I fix CVE-2025-1972?
To fix CVE-2025-1972, update the WordPress Export and Import Users and Customers plugin to version 2.6.3 or higher.
Who is affected by CVE-2025-1972?
CVE-2025-1972 affects users of the WordPress Export and Import Users and Customers plugin in versions up to and including 2.6.2.
What type of vulnerability is CVE-2025-1972?
CVE-2025-1972 is an arbitrary file deletion vulnerability resulting from insufficient file path validation.
Can CVE-2025-1972 be exploited without authentication?
No, CVE-2025-1972 requires an authenticated user with administrative privileges to exploit the vulnerability.