CVE-2026-87836

Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.

Affected

Comments Import & Export

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-09-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ed416bc1-27b7-4840-953a-e0aa925b9336/

References

• CVE Record
• NVD entry