CVE-2026-87836 — Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

CVE-2026-87836

Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export PUBLISHED

Description (CNA)

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.

Affected (CNA)

Vendor / product	Versions
Unknown / Comments Import & Export	affected 2.1.11 before 2.5.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ed416bc1-27b7-4840-953a-e0aa925b9336/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.