The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Users Customers Import Export For Wp Woocommerce Plugin | — | Update users-customers-import-export-for-wp-woocommerce plugin to version 2.4.2, or a newer patched version | May 15, 2025 | Jul 14, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub