# CVE-2026-87836: Comments Import & Export plugin Author+ comment PII disclosure via export

Source: https://junglewise.ai/threats/cve-2026-87836-comments-import-export-plugin-author-comment-pii-disclosure-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87836 · Severity: low · CVSS 2.7 · Published 2026-09-17

The Comments Import & Export WordPress plugin fails to properly restrict access to comment export functionality, allowing user accounts with Author role and above to download all comments from a website—including unapproved comments, commenter email addresses, IP addresses, and internal metadata. This exposure of sensitive data could reveal private information about site commenters and compromise user privacy.

Vendors: [WPScan](https://junglewise.ai/threats/vendors/wpscan).

## Quick answers

**Is CVE-2026-87836 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87836 being exploited in the wild.

**How severe is CVE-2026-87836?** Low severity, with a CVSS score of 2.7, published 17 September 2026.

**Which products and versions are affected?** WPScan Comments Import & Export 2.1.11 through 2.5.3.

**Is there a fix for CVE-2026-87836?** A patch was published on 2026-09-17: Fixed in version 2.5.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87836 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-87836?** Check whether you run WPScan Comments Import & Export at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass / sensitive data exposure (CWE-200) in the comment export feature. The plugin does not validate that the requesting user has comment moderation capabilities, nor does it scope exports to only the user's own content. Any authenticated user with Author role or higher can call the export function to retrieve all comments on the site, including unapproved comment content, commenter email addresses, IP addresses, and comment meta. No network-based exploitation or special preconditions are required beyond having a valid author-level account. The vulnerability is fixed in version 2.5.4 and above.

## Affected products

- WPScan Comments Import & Export 2.1.11 through 2.5.3

## Timeline

- 2026-09-15: disclosed
- 2026-09-17: patched: Fixed in version 2.5.4

## References

- [https://wpscan.com/vulnerability/ed416bc1-27b7-4840-953a-e0aa925b9336/](https://wpscan.com/vulnerability/ed416bc1-27b7-4840-953a-e0aa925b9336/)