Vulnerabilities and security researches forcustomizer-export-import customizer-export-import

Jun 06, 2024

CVE, Research URL: CVE-2023-1347
Home page URL: Security reports for Customizer Export/Import
Application: Customizer Export/Import
Date: May 08, 2023
Research Description: The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Affected versions: max 0.9.6.
Status: vulnerable

CVE, Research URL: CVE-2022-3380
Home page URL: Security reports for Customizer Export/Import
Application: Customizer Export/Import
Date: Oct 31, 2022
Research Description: The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Affected versions: max 0.9.5.
Status: vulnerable

Sep 07, 2024

CVE, Research URL: CVE-2024-7620
Home page URL: Security reports for Customizer Export/Import
Application: Customizer Export/Import
Date: Sep 07, 2024
Research Description: The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
Affected versions: max 0.9.7.1.
Status: vulnerable

Oct 26, 2026

PSC, Research URL: PSC-2026-65716
Home page URL: Security reports for Customizer Export/Import
Application: Customizer Export/Import
Date: Oct 26, 2026
Research Description: Theme settings migration processes uploaded configuration data and can replace values that control a live site appearance. Customizer Export/Import version 0.9.8 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65716. The review focused on Customizer permissions, export output, uploaded settings validation, theme compatibility, option import, and optional image handling.
Affected versions: Min 0.9.8, max 0.9.8.
Status: SAFE & CERTIFIED