Description
WordPress Plugin Import Export WordPress Users is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently import new users via a CSV file, including administrative-level users. WordPress Plugin Import Export WordPress Users version 1.3.8 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.3.9 or latest
References
https://www.wordfence.com/blog/2020/03/vulnerability-patched-in-import-export-wordpress-users/
https://plugins.svn.wordpress.org/users-customers-import-export-for-wp-woocommerce/trunk/readme.txt
Related Vulnerabilities
WordPress 5.5.x Multiple Vulnerabilities (5.5 - 5.5.3)
WordPress Plugin Mapplic-Custom Interactive Map Server-Side Request Forgery (6.1)
Envoy Proxy Detection of Error Condition Without Action Vulnerability (CVE-2024-30255)
WordPress Plugin WP-Stateless-Google Cloud Storage Remote Code Execution (2.2.0)
Elgg Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2021-3964)