Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function

Vulnerability

The Export and Import Users and Customers plugin for WordPress (versions up to and including 2.6.2) contains a path traversal vulnerability in the download_file() function. This allows authenticated attackers with Administrator-level access or higher to read arbitrary log files from the server file system. The plugin is developed by WebToffee and is available on the WordPress plugin repository. The affected versions are all releases prior to 2.7.3. [1]

Exploitation

An attacker must have Administrator-level privileges on the WordPress site. No additional authentication is required beyond that. The attacker exploits the download_file() function by manipulating file path parameters to traverse directories and read arbitrary .log files (or other files with appropriate extensions) stored on the server. The exact sequence involves sending a crafted request that includes path traversal sequences such as ../ to navigate to sensitive log directories. The vulnerability does not require any user interaction or special network position, as it can be triggered via HTTP requests to the WordPress admin interface. [1]

Impact

Successful exploitation allows an attacker to read the contents of arbitrary log files on the server. These log files may contain sensitive information such as database credentials, error messages, internal paths, or personal data. The compromise is limited to file read access; no write or execute capabilities are gained. The information disclosure can lead to further attacks if the exposed data includes secrets or PII. [1]

Mitigation

A patched version (2.7.3) was released on 2026-05-07, according to the WordPress plugin directory. Users should update to version 2.7.3 or later immediately. For sites that cannot be updated, the only workaround is to restrict Administrator-level access to trusted users only, as the vulnerability requires admin privileges. The plugin is actively maintained and tested up to WordPress 6.9.4. There is no indication that this CVE has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. [1]