Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

Vulnerability

The validate_file() function in all versions up to 2.6.2 of the Export and Import Users and Customers plugin for WordPress performs insufficient input validation, allowing an attacker to inject URLs. This function is reachable during file import/export operations.

Exploitation

An authenticated attacker with Administrator-level access can exploit this by providing a malicious URL in the file validation process. No additional privileges or user interaction are required. The function processes the URL and makes a server-side request, enabling the attacker to scan internal networks and interact with internal services.

Impact

Successful exploitation allows the attacker to make HTTP requests to arbitrary internal or external hosts from the WordPress server's context. This can lead to information disclosure from internal services and potentially data modification if those services accept unauthenticated writes. The attacker gains the ability to query and modify information from internal services, escalating beyond typical administrative privileges within the internal network.

Mitigation

The plugin vendor has released version 2.7.3 which fixes the issue, as indicated by the plugin's update history [1]. Users are strongly advised to update to at least 2.7.3. No workarounds are documented. The vulnerability is not listed in CISA's KEV as of the publication date.