Skip to content
PluginCanary

Export and Import Users and Customers

by WebToffee · 50,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: released 10 days ago, tested with WordPress 7.1, no open vulnerabilities.

86/ 100Healthy
Canary Score

Based on 4 of 5 areas

Sub-scores for Export and Import Users and Customers
Ownership100
Maintenance100
Security60
SupportNo data
Reputation85

How the score works

Active signals

Open issues right now, with links to the source.

  • InfoSEC-35 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

History: 11 past vulnerabilities, all patched. Patched issues are listed in the Security record, not here.

Quick answers

Is Export and Import Users and Customers still maintained?
Yes. Last release 26 Oct 2026, 19 releases in the last 24 months. 26 Oct 2026 · wordpress.org
Who owns Export and Import Users and Customers, and has it changed hands?
No change recorded. Main committer webtoffee since Jul 2018. 4 Nov 2026 · SVN log
Was Export and Import Users and Customers removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Export and Import Users and Customers safe?
11 known vulnerabilities, all fixed (latest in 2.7.6). Not on the exploited list. 29 Oct 2026 · Wordfence Intelligence
Is the latest Export and Import Users and Customers update safe to install?
No ownership change before 2.7.7. No one-star spike after it. 26 Oct 2026 · Release history

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
webtoffee9 Jul 2018 to 26 Oct 2026, 129 commits

1 committer recorded. No ownership changes recorded since 2016.

Maintenance

Last release
10 days ago
Releases, 24 months
19
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Export and Import Users and Customers
Q1 20245
Q2 20241
Q3 20242
Q4 20243
Q1 20253
Q2 20251
Q3 20252
Q4 20253
Q1 20263
Q2 20262
Q3 20261
Q4 20262

Last release 26 Oct 2026. Tested with WordPress 7.1 (current).

Support

Resolved, last 2 months
100%
Threads, last 2 months
1

Trend appears after 8 weekly snapshots.

Security record

5 vulnerabilities in 24 months (11 on record), all patched (latest fixed in 2.7.6).

Show 11 patched vulnerabilities
DateIssueCVSSAffectedFixed inDays to patch
29 Oct 2026Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field8.8<= 2.7.52.7.6Before disclosure
21 Mar 2025Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function4.9<= 2.6.22.6.3Same day
21 Mar 2025Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function2.7<= 2.6.22.6.3Same day
21 Mar 2025Authenticated (Admin+) PHP Object Injection via form_data Parameter7.2<= 2.6.22.6.3Same day
21 Mar 2025Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function7.6<= 2.6.22.6.3Same day
22 Apr 2024Authenticated (Admin+) PHP Object Injection7.2<= 2.5.32.5.4Before disclosure
28 Mar 2024Authenticated (Shop Manager+) Path Traversal2.7<= 2.5.22.5.3Before disclosure
12 Dec 2023Authenticated (Shop Manager+) Arbitrary File Upload7.2<= 2.4.82.4.9Same day
14 Jul 2023Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change7.2<= 2.4.12.4.2Same day
11 Mar 2020WebToffee Plugins <= (Various Versions) - Arbitrary User Creation8.8< 1.3.91.3.9Before disclosure
22 Aug 2018CSV Injection7.3< 1.3.21.3.2366

Changelog mentions of security fixes: 2.7.6 (security); 2.7.7 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Reputation

Last 90 days: 5.0 (2 reviews). Lifetime: 4.8.

Last 90 days vs lifetime average rating for Export and Import Users and Customers
Last 90 days5.0
Lifetime4.8
Average rating per quarter
Average rating per quarter for Export and Import Users and Customers
Q3 20245.0
Q4 20244.5
Q1 20255.0
Q2 20255.0
Q3 20255.0
Q4 20253.8
Q1 20265.0
Q2 20265.0
Q3 20264.0

Average rating fell from 5.0 to 4.0 between Q3 2024 and Q3 2026.

Rating distribution
5 star412
4 star9
3 star2
2 star3
1 star16
Latest low reviews

Momentum

Active installs
50,000+
Downloads, last full week
28,601
Weekly downloads, last 26 complete weeks
Weekly downloads for Export and Import Users and Customers
4 May 20265,308
11 May 20266,866
18 May 20267,620
25 May 202622,285
1 Jun 20266,259
8 Jun 20264,108
15 Jun 20263,284
22 Jun 20262,763
29 Jun 20262,651
6 Jul 20265,142
13 Jul 20262,186
20 Jul 20262,458
27 Jul 20262,326
3 Aug 20262,089
10 Aug 20261,962
17 Aug 202625,001
24 Aug 20266,196
31 Aug 20264,272
7 Sep 20263,278
14 Sep 20263,056
21 Sep 20262,981
28 Sep 20262,873
5 Oct 20262,504
12 Oct 202622,012
19 Oct 20267,150
26 Oct 202628,601

Weekly downloads over the last 4 weeks are 111% above the 26-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score. Never sponsored.

Widget Importer & ExporterScore 95 · 200,000+Customizer Export/ImportScore 95 · 100,000+WP All ExportScore 95 · 100,000+

Facts

Version
2.7.7
Author
WebToffee
Added
22 Oct 2016
Last updated
26 Oct 2026
Active installs
50,000+
Requires WordPress
3.0.1
Tested up to
7.1.4
Requires PHP
7.4
Category
E-commerce & Shopping
Tags
import-export, export customers, import customers, Export Users to CSV, import users from csv

Other plugins by this author: Product Import Export for WooCommerce, Order Export & Order Import for, Sequential Order Number for WooCommerce, WebToffee WooCommerce PDF Invoices, Smart Coupons For WooCommerce Coupons, Related Products, WebToffee eCommerce Marketing Automation, WebToffee WP Backup and Migration, mPDF add-on for RTL and Unicode Support, WebToffee WooCommerce Product Feeds, Comments Import & Export, WebToffee Gift Cards for WooCommerce

Questions about Export and Import Users and Customers

Is Export and Import Users and Customers still maintained?

Yes. Last release 26 Oct 2026, 19 releases in the last 24 months.

Who owns Export and Import Users and Customers, and has it changed hands?

No change recorded. Main committer webtoffee since Jul 2018.

Was Export and Import Users and Customers removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Export and Import Users and Customers safe?

11 known vulnerabilities, all fixed (latest in 2.7.6). Not on the exploited list.

Is the latest Export and Import Users and Customers update safe to install?

No ownership change before 2.7.7. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue