Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-87836

Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-87836

Published

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-87836

Published

Comments Import & Export

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Comments Import & Export",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "2.1.11",
                            "lessThan": "2.5.4"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON