The Export and Import Users and Customers WordPress plugin suffers from a Server‑Side Request Forgery vulnerability in versions up to and including 2.6.2. The flaw resides in the validate_file() function, which does not properly restrict the locations that can be requested. Authenticated attackers who possess Administrator-level credentials can trigger the function to perform HTTP or HTTPS requests to arbitrary internal or external endpoints from the web server. This enables the attacker to read from, modify, or otherwise interact with sensitive internal services, thereby compromising confidentiality, integrity, and potentially availability of those services over the course of the request. The vulnerability is classified as CWE‑918, a classic SSFR weakness.

The affected product is the WordPress plugin "Export and Import Users and Customers" from WebToffee, with all versions 2.6.2 and earlier. Administrators or higher privileged users operating within any WordPress site that hosts the plugin are within the scope of the vulnerability.

The CVSS score of 7.6 indicates a high severity, but the EPSS score of less than 1% suggests that the demonstrated exploitation likelihood is low at present. Even though the vulnerability requires authenticated administrative access—an access level that is reasonably restrictive—the presence of the flaw still represents a serious internal threat, particularly if the WordPress installation is exposed to a wider threat surface or if privileged accounts are compromised. The vulnerability is not listed in the CISA KEV catalog, so no publicly documented exploits are yet claimed in that database. Nonetheless, the nature of the flaw makes it a strong candidate for preemptive remediation.