{"id":"CVE-2026-87836","aliases":["EUVD-2026-81345","GHSA-2fm8-39xv-9vv2"],"status":"published","title":"Comments Import \u0026 Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export","description":"The Comments Import \u0026 Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00316,"percentile":0.2483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-09-17T06:00:11Z","modified":"2026-09-18T19:08:32Z","products":[{"vendor":"unknown","product":"comments import \u0026 export"},{"vendor":"webtoffee","product":"comments import \u0026 export"}],"references":[{"url":"https://wpscan.com/vulnerability/ed416bc1-27b7-4840-953a-e0aa925b9336/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87836"},{"url":"https://wpscan.com/vulnerability/ed416bc1-27b7-4840-953a-e0aa925b9336"},{"url":"https://github.com/advisories/GHSA-2fm8-39xv-9vv2"}],"sources":{"cve":[{"id":"CVE-2026-87836","title":"Comments Import \u0026 Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export","description":"The Comments Import \u0026 Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.","status":"published","published":"2026-09-17T06:00:11.361Z","modified":"2026-09-17T12:28:29.854Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-81345","description":"The Comments Import \u0026 Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.","status":"published","published":"2026-09-17T06:00:11Z","modified":"2026-09-17T12:28:29Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:13.536818Z"}],"ghsa":[{"id":"GHSA-2fm8-39xv-9vv2","title":"The Comments Import \u0026 Export WordPress plugin before 2.5.4 does not restrict its comment export...","description":"The Comments Import \u0026 Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.","status":"published","published":"2026-09-17T06:30:34Z","modified":"2026-09-17T15:32:13Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:04.687174Z"}],"nvd":[{"id":"CVE-2026-87836","description":"The Comments Import \u0026 Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.","status":"published","published":"2026-09-17T06:16:51.88Z","modified":"2026-09-18T19:08:32.83Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:49.013904Z"}]}}