Import and export users and customers Security & Risk Analysis
wordpress.org/plugins/import-users-from-csv-with-metaImport and export users and customers including user meta, roles, and other. Compatible with many plugins. Do it from the front end or using cron.
Is Import and export users and customers Safe to Use in 2026?
Generally Safe
Score 93/100Import and export users and customers has a strong security track record. Known vulnerabilities have been patched promptly.
The "import-users-from-csv-with-meta" v2.0 plugin exhibits a mixed security posture. While the static analysis shows a good number of entry points are protected by authorization and nonce checks, several concerning code signals and historical vulnerability patterns warrant careful consideration. The presence of the "unserialize" function, even if not directly flagged as a critical taint flow, is a known risk for deserialization vulnerabilities if user-supplied data is ever passed to it without strict validation. The taint analysis revealing a high severity flow with unsanitized paths indicates a potential for serious security issues like path traversal or file inclusion if this flow is exploitable by an attacker.
The plugin's vulnerability history is a significant concern. With a total of 20 known CVEs, including a substantial number of high-severity issues, it suggests a recurring pattern of introducing security flaws. The breadth of vulnerability types, from sensitive information exposure and XSS to deserialization, RFI, and path traversal, points to a need for more robust secure coding practices throughout its development lifecycle. Although there are currently no unpatched CVEs, the sheer volume and variety of past vulnerabilities create an inherent risk and require vigilant monitoring and timely updates. The plugin's strengths lie in its protected entry points, but the identified code signals and historical context necessitate a cautious approach.
Key Concerns
- High severity taint flow found
- Use of 'unserialize' function
- Significant historical CVEs (20)
- Multiple high severity past CVEs (6)
- Many medium severity past CVEs (14)
- Low percentage of properly escaped output (62%)
- Unsanitized paths in taint flows (2)
Import and export users and customers Security Vulnerabilities
CVEs by Year
Severity Breakdown
20 total CVEs
Import and export users and customers <= 1.27.12 - Unauthenticated Sensitive Information Disclosure
Import and export users and customers <= 1.27.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Import and export users and customers <= 1.26.8 - Unauthenticated Information Exposure
Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Import and export users and customers <= 1.26.5 - Missing Authorization
Import and export users and customers <= 1.26.2 - Authenticated (Admin+) PHP Object Injection
Import and export users and customers <= 1.24.6 - Missing Authorization via fire_cron REST endpoint
Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality
Import and export users and customers <= 1.20.4 - Authenticated (Subscriber+) CSV Injection
Import and export users and customers <= 1.19.2 - Stored Cross-Site Scripting
Import and export users and customers <= 1.16.3.5 - CSV injection via a customer's profile
Import and export users and customers 1.15 - Sensitive Data Exposure
Import and export users and customers <= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion & Path Traversal
Import and export users and customers <= 1.14.2.1 - Directory Traversal
Import and export users and customers <= 1.14.1.2 - Cross-Site Scripting
Import and export users and customers <= 1.14.0.2 - Cross-Site Scripting
Import and export users and customers <= 1.14.0.2 - Cross-Site Request Forgery
Import users from CSV with meta <= 1.12 - Import Cross-Site Scripting
Import and export users and customers Code Analysis
Dangerous Functions Found
SQL Query Safety
Output Escaping
Data Flow Analysis
Import and export users and customers Attack Surface
AJAX Handlers 14
REST API Routes 1
Shortcodes 3
WordPress Hooks 155
Maintenance & Trust
Import and export users and customers Maintenance & Trust
Maintenance Signals
Community Trust
Import and export users and customers Alternatives
Widget Importer & Exporter
widget-importer-exporter
Import and export your widgets.
WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress
wp-ultimate-csv-importer
Effortlessly import, export, and migrate your WordPress data with WP Ultimate CSV Importer. This all-in-one solution supports CSV, XML, and Excel file …
WP Options Importer
options-importer
Export and import WordPress Options.
Spots Import/Export
spots-importexport
** NOTE I have not had a use case for this plugin for a couple years. Keeping it for posterity here. If you would like to take over development let me …
Product Import Export for WooCommerce – Import Export Product CSV Suite
product-import-export-for-woo
Easily import/export WooCommerce products (simple, grouped, external/affiliate) via CSV. Transfer product data, including images, reviews, categories, …
Import and export users and customers Developer Profile
3 plugins · 81K total installs
How We Detect Import and export users and customers
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/import-users-from-csv-with-meta/assets/style.css/wp-content/plugins/import-users-from-csv-with-meta/assets/script.js//cdn.datatables.net/2.2.2/js/dataTables.min.jsimport-users-from-csv-with-meta/assets/style.css?ver=import-users-from-csv-with-meta/assets/script.js?ver=HTML / DOM Fingerprints
acui-fielddata-user-idacui_js_object