CVE-2023-6583 is a medium severity directory traversal in the Import and Export Users and Customers plugin from Codection. Through the Recurring Import feature, an administrator may read and delete arbitrary server files, including wp-config.php. The record lists versions up to 1.24.2. Update past 1.24.2.
What's affected
- Product: Import and Export Users and Customers from Codection, a WordPress plugin.
- Affected: all versions up to and including 1.24.2, per the record.
- Fixed version: not named in the record. A Trac changeset (3007057) is linked.
- Access needed: administrator. Impact: read and delete arbitrary files.
The record gives a CVSS 3.1 base score of 6.6 (medium) with the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the plugin version on each site.
- Update to a release newer than 1.24.2 and confirm in the changelog.
- Review administrator accounts and remove unneeded ones.
- Keep file backups and a copy of wp-config.php off the web server, since the record mentions deletion as well as reading.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-98 (PHP Remote File Inclusion): A PHP include or require statement uses a filename that an outside party can influence, which can pull unintended files into the running program. ; CWE-22 (Path Traversal): A path built from user input is not confined to the intended directory, so a request can reach files elsewhere on the server.
The record lists path traversal and PHP file inclusion. A path taken from a setting is not confined to the folder the feature was built for, so it can point at files elsewhere on the server, such as the configuration file that holds database credentials.
Administrator access is required, so this is a risk for sites with several admins or a stolen admin login. Deleting wp-config.php is notable, since WordPress may then act as if it is not installed. Offline backups and a short admin list reduce the damage.
Quick check
Why is it only medium?
It needs administrator rights. The base vector gives 6.6.
Can it delete files?
Yes. The record says an administrator can read and delete the contents of arbitrary files.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
