Executive brief
The Comments Import & Export WordPress plugin fails to properly restrict access to comment export functionality, allowing user accounts with Author role and above to download all comments from a website—including unapproved comments, commenter email addresses, IP addresses, and internal metadata. This exposure of sensitive data could reveal private information about site commenters and compromise user privacy.
Technical details
The vulnerability is an authorization bypass / sensitive data exposure (CWE-200) in the comment export feature. The plugin does not validate that the requesting user has comment moderation capabilities, nor does it scope exports to only the user's own content. Any authenticated user with Author role or higher can call the export function to retrieve all comments on the site, including unapproved comment content, commenter email addresses, IP addresses, and comment meta. No network-based exploitation or special preconditions are required beyond having a valid author-level account. The vulnerability is fixed in version 2.5.4 and above.
Affected products
- WPScan Comments Import & Export 2.1.11 through 2.5.3
Timeline
- 2026-09-15: disclosed
- 2026-09-17: patched: Fixed in version 2.5.4