Known vulnerabilities in Import and export users and customers

Bulk import and export WordPress users and WooCommerce customers from CSV, including roles, passwords and any custom meta.

21Reported vulnerabilities

8.8Highest CVSS score

2.4.13Latest version

70,000+Active installs

What to do now

Update Import and export users and customers to 2.4.3 or later. 21 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2020-22277	High 8	1.8%	1.15.5.11 and earlier	`1.16.3.6`	November 4, 2020
CVE-2019-14683	Medium 5.7	0.7%	Before 1.14.2.2	`1.14.2.2`	August 8, 2019
CVE-2026-7641	High 8.8	0.7%	0 to 2.0.8 (inclusive)	`2.0.9`	May 2, 2026
CVE-2019-15329	High 8.8	0.7%	Before 1.14.0.3	`1.14.0.3`	August 22, 2019
CVE-2019-15326	High 7.5	2.3%	Before 1.14.2.1	`1.14.2.1`	August 22, 2019
CVE-2026-3629	High 8.1	0.4%	0 to 1.29.7 (inclusive)	`2.0`	March 21, 2026
WF-e46ff294-0be1-47c1-8c21-f6242c6f832a	High 7.7	—	1.15 to 1.15 (inclusive)	`1.15.0.1`	January 1, 2020
CVE-2024-32817	High 7.2	0.4%	1.26.2 and earlier	`1.26.3`	April 22, 2024
CVE-2019-15328	Medium 6.1	0.9%	Before 1.14.0.3	`1.14.0.3`	August 22, 2019
CVE-2019-15327	Medium 6.1	0.9%	Before 1.14.1.3	`1.14.1.3`	August 22, 2019
CVE-2018-20101	Medium 6.1	0.8%	1.12.1 to 1.12.1 (inclusive)	`1.12.1`	December 12, 2018
CVE-2025-24689	Medium 5.3	0.3%	1.27.12 and earlier	`1.27.13`	January 27, 2025
CVE-2024-38787	Medium 5.3	0.4%	1.26.8 and earlier	`1.26.9`	August 7, 2024
CVE-2024-22151	Medium 5.3	0.3%	1.24.6 and earlier	`1.24.7`	January 16, 2024
CVE-2025-15673	Medium 4.9	0.3%	Before 2.4.3	`2.4.3`	July 24, 2026
CVE-2024-50413	Medium 4.4	0.3%	1.27.5 and earlier	`1.27.6`	October 24, 2024
CVE-2024-4734	Medium 4.4	0.3%	1.26.6.1 and earlier	`1.26.7`	May 14, 2024
CVE-2024-4656	Medium 4.4	0.3%	1.26.6.1 and earlier	`1.26.7`	May 14, 2024
CVE-2026-15026	Medium 4.3	0.4%	0 to 2.4.0 (inclusive)	`2.4.1`	July 10, 2026
CVE-2024-34815	Medium 4.3	0.4%	1.26.5 and earlier	`1.26.6`	May 9, 2024
CVE-2024-1050	Medium 4.3	0.4%	0 to 1.26.5 (inclusive)	`1.26.6`	May 4, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.