What’s Vulnerable › Vulnerabilities
CVE-2026-87836: Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export
- Severity: low (CVSS 2.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-17 · updated 2026-09-18
- Weakness: CWE-200
Description
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.
Affected products
- Comments Import & Export: from 2.1.11 before 2.5.4 — fixed in 2.5.4
How to fix
Upgrade to a fixed version: Comments Import & Export 2.5.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-87836 or the next vulnerability affects your stack