Magic Export & Import
Magic Export & Import has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).
The one issue recorded for Magic Export & Import has a vendor fix available, so running the current release closes it.
All of these findings were reported by Hoang Phuong. Magic Export & Import is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-5335Magic Export & Import <= 1.1.0 - Unauthenticated Information Exposure
Read the full analysisVulnerability Records

Magic Export & Import
Author
kovalchik8
Magic Export & Import is a lightweight plugin that provides a powerful and flexible way to export and import content maintaining exact appearance. It supports migrating: Posts, including custom post types Terms, including custom taxonomies Users, with filtering options by user role All types of comments, including product reviews WooCommerce orders, with full support for High-Performance Order Storage (HPOS) Registered WordPress menus Content of ACF Options pages Key features: Simple one click exports and imports Related data types exported within the same file: terms, users, products, coupons and other items referenced by the exported content ride along and are imported first, so all the references resolve on the destination site Interactive related data graph: review what will travel with the export, exclude whole types or single items, and hover any item to see why it is included Automatic reference resolution: URLs and ID references within the content and custom fields (including ACF fields and Gutenberg synced patterns) are converted during export and resolve back on import Advanced filtering options for exports: partial exports, date ranges, statuses, taxonomies and user roles Support for media attachments, with automatic download of missing media files on import Cross-domain support – URLs automatically update to match the new site Test mode for previewing result before executing the actual import, preventing unintended changes Real-time progress tracking with logs and controls, for both export and import — large sites don’t hit request timeouts File-based caching of the export page data, keeping the admin pages fast on sites with a lot of content Developer-friendly hooks to modify exporting and importing data Built-in support for popular plugins: Advanced Custom Fields (ACF) Advanced Custom Fields: Extended WooCommerce, including High-Performance Order Storage (HPOS) Polylang Yoast SEO Contact Form 7 Important notes: Posts and Terms Identification. During import, existing posts and terms are identified by their slugs. If a post or term with the same slug exists on the destination site, it will be updated rather than creating a duplicate entry. This applies to all supported post types and taxonomies. Migration Order. Content is migrated in dependency order automatically when “Export related data types and referenced items” is used: related data (e.g. Terms for Posts; Users, Products and Coupons for Shop Orders) is placed into the same export file and imported first, so all the references resolve. When exporting without related data types, migrate content in dependency order manually: Terms (categories, tags etc.) before Posts, and Users before Shop Orders. Related Data Types. The discovered related types and items are shown as an interactive graph before exporting: click a type to exclude it, double-click to show its individual items, and hover an item to see why it is included. Excluding a node also prunes the items reachable only through it. On import, by default missing related items are created and existing ones are kept untouched, but this can be changed with the separate related items import settings (only create new / only update existing), same as for the main items. Shop Order Numbers. By default, WooCommerce uses order IDs as order numbers. During the import process, new IDs will be created, leading to different order numbers. To preserve order numbers, ensure that both the source and destination sites use plugin or configuration that do not depend on order IDs for order numbering. Downloadable Products. Downloadable files linked to Products can only be migrated if they are hosted on the source domain and accessible via direct URLs. Files that are protected or stored outside the source domain cannot be transferred. Plugin Version Consistency. The export file must be generated using the same plugin version as the one installed on the importing site. Importing a file created with a different plugin version is not supported and may lead to unexpected results.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C