CVE-2025-1973

Summary

CVE-2025-1973 is a path traversal vulnerability affecting the Export and Import Users and Customers plugin for WordPress. This issue, present in versions 2.6.2 and below, allows authenticated attackers with Administrator-level access or higher to read the contents of arbitrary log files on the server. The vulnerability is due to the flawed implementation of the download_file() function, which can be exploited to traverse directories and access sensitive information contained within these logs. This vulnerability poses a significant risk to WordPress installations, and it is recommended that users upgrade to the latest version of the plugin as soon as possible to mitigate the threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.