CVE-2024-13562: The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.5 via the uploads direc

high Affects import-wp (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-01-25; advisory modified 2026-06-17.

The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.5 via the uploads direc

Package: import-wp (WordPress plugin) WordPress
Affected versions: <2.14.6
Fixed in: 2.14.6
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 0% (38.3th percentile)
Published: 2025-01-25
Source: nvd

References

CWE-200

NVD record import-wp (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-1273 high The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some ca same package: import-wp (WordPress plugin)
CVE-2023-7253 medium The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrato same package: import-wp (WordPress plugin)
CVE-2017-5487 medium wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implemen same weakness: CWE-200
CVE-2018-7251 critical Anchor CMS Logs Credentials same weakness: CWE-200
CVE-2021-39327 medium The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosur same weakness: CWE-200
CVE-2009-0815 medium TYPO3 leaks a hash secret in an error message same weakness: CWE-200