Import Users from CSV

Import Users from CSV has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (100%).

The one issue recorded for Import Users from CSV has a vendor fix available, so running the current release closes it.

All of these findings were reported by Trình Vũ. Import Users from CSV is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
7.2/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Import Users from CSV vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2024-32431

Import Users from CSV <= 1.2 - Authenticated (Admin+) PHP Object Injection

Read the full analysis

Vulnerability Records

1 records
Import Users from CSV banner
Latestv1.3.1

Import Users from CSV

WP All Import

Author

WP All Import

4.1(44)
82/100
Last Updated
2026-07-30 (1mo ago)
Active Installs
10,000+
Downloads
293,286
Requires WP
3.1+
Requires PHP
7.0+
Tested up to
WP 7.0.4
Created
2011-05-23 (16y ago)

This plugin allows you to import users from an uploaded CSV file. It will add users with basic information as well as meta fields and user role. You can also choose to send a notification to the new users and to display password nag on user login. Check out our other free plugins. Features Imports all users fields Imports user meta Update existing users by specifying ID field Allows setting user role Sends new user notification (if the option is selected) Shows password nag on user login (if the option is selected) For feature request and bug reports, please use the forums. Code contributions are welcome on Github. Import Users From Any CSV/Excel/XML with WP All Import Pro WP All Import Pro can import WordPress users, WooCommerce products, ACF, custom post types, custom fields, taxonomies, and everything else: Drag & Drop to Import Any File: Give any CSV or XML to WP All Import, then drag and drop to map data from your file into WordPress. Any Custom Post Type, Every Data Type: Import data to custom post types, with support for WooCommerce, ACF, custom fields, taxonomies, and everything else. Import Images & Galleries: Images can be uploaded, downloaded, or matched to media already in WordPress. Full support for WooCommerce product images and variation galleries. Import Files from URL: Download and import files from external websites, even if they are password protected. URL imports are can be re-run to add, edit, and delete posts. Scheduled Imports: WP All Import Pro can check periodically check a file for updates and then add, update, or delete to the imported posts accordingly. Developer Friendly: Pass data through custom PHP functions. For example, use something like [my_function( {user_email[1]} )] in your template, to pass the value of {user_email[1]} to my_function and display whatever it returns. Priority Support: Personal support from our team of expert developers with over a decade of experience importing and exporting WordPress data. 90 Day Money Back Guarantee: Not 100% happy? Let us know, and we’ll promptly send you a refund. No questions asked. Check out WP All Import today. Import users with WP All Import Pro. Need to import XML and CSV to WooCommerce? Check out our WooCommerce add-on. How to export WordPress users? Drag & drop to export WordPress users (and everything else) to a custom CSV, Excel, or XML with WP All Export Pro.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C