Information disclosure in Comments Import & Export
CVE-2026-87836
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.
Vulnerability class: Information Disclosure
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Unknown Comments Import & Export
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-87836?
- CVE-2026-87836 is a low-severity vulnerability in Comments Import & Export, classified under Information Disclosure. CVSS score: 2.7/10. Published 2026-09-17.
- How severe is CVE-2026-87836?
- Low severity. CVSS v3 base score is 2.7 out of 10.