CVE-2026-16542: Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

Q: Who can exploit this issue?

An attacker needs high-privileged access to the WordPress site and must be able to perform a CSV import using the affected plugin. This is not described as an unauthenticated or low-privileged attack.

Q: What input triggers the server-side request?

A user-supplied URL in the bp_avatar field during a CSV import is requested by the server without validation. An attacker with the required privileges can use that behavior to make server-side requests.

Q: Which versions are affected?

Versions of Import and export users and customers before 2.4.5 are affected. Updating to version 2.4.5 or later addresses the stated vulnerable version range.

Published Sep 20, 2026

Updated

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

Affected Software

1 affected component

WordPress plugin Import and export users and customers<2.4.5

Event History

Sep 20, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs high-privileged access to the WordPress site and must be able to perform a CSV import using the affected plugin. This is not described as an unauthenticated or low-privileged attack.

What input triggers the server-side request?

A user-supplied URL in the bp_avatar field during a CSV import is requested by the server without validation. An attacker with the required privileges can use that behavior to make server-side requests.

Which versions are affected?

Versions of Import and export users and customers before 2.4.5 are affected. Updating to version 2.4.5 or later addresses the stated vulnerable version range.