Import and export users and customers

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 37% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ kentsmythe

   3mo ago

   The plugin did exactly what I needed. Support was quick and friendly. Solved my one issue immediately.

   Read on wp.org ↗
2. ★★★★★ pendle666

   3mo ago

   I was having an issue with some settings for users, and all I wanted was a list of all my users and what each setting was. Although it gave me loads of columns, I found what I was looking for and was able to do my changes without having to look at each individual user.

   Read on wp.org ↗
3. ★★★★★ felixsh

   4mo ago

   This plugin is very useful and works well for our user import workflow.The developer was very helpful, responsive, and open to feedback. It is great to see that the plugin is actively maintained and improved. Looking forward to using it in the future. Thanks Javier! 🙂

   Read on wp.org ↗
4. ★★★★★ wpnovice2

   12mo ago

   I’ve used this for years, importing classlists and updating classlists each term with my courses. Lots of detailed options, I haven’t tried them all, but the ones I have used have all worked well, especially related to user roles and custom fields.

   Read on wp.org ↗
5. ★★★★★ Arischvaran Puvanesvaran

   1.2y ago

   Used this on a client site, since WP All Import Export free version is actually not “free” at all. It even managed to import the custom roles that I created using the Members plugin. Thanks for the great work!

   Read on wp.org ↗
6. ★★★★★ Paolo Beccari

   1.2y ago

   I had to transfer 900+ users of an old website (not WP), furthermore the target project is full of custom fields, extra user roles and further data. After exporting some test users on a CSV file I checked and edited all the field names in order to match my new WP website structure.The final import of all 900+ users was quick and precise.Everything smooth like oil. Anything you can imagine to export on a CSV file can be easily imported into WP, you just need to be very precise and careful with the names of the columns you need to import.Just remember: username and email columns MUST be the first ones in any import file!

   Read on wp.org ↗
7. ★★★★★ natashaconnectedmarketing

   1.3y ago

   This plugin did exactly what I needed in 5 minutes and didn’t crash my site like some other plugins. I highly recommend.

   Read on wp.org ↗
8. ★★★★★ Henry Douglas

   1.3y ago

   Great plugin.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.4.4 Security fix: the BuddyPress/BuddyBoss bp_avatar CSV import now also rejects link-local ( 169.254.0.0/16 ), carrier-grade NAT ( 100.64.0.0/10 , 198.18.0.0/15 ) and other private IP ranges after resolving the URL’s host, 2.4.4
2. — Version 2.4.3 Security fix: the BuddyPress/BuddyBoss bp_avatar CSV import now fetches remote URLs with wp_safe_remote_get() instead of file_get_contents() , preventing a Server-Side Request Forgery that let an admin-supplied URL make 2.4.3
3. — Version 2.4.2 Security fix: added current_user_can('promote_users') check (plus filtering against the actor’s editable roles) before applying any role during import, preventing a user with only create_users from creating or promoting 2.4.2
4. — Version 2.4.1 Security fix: the acui_email_template_selected AJAX handler now requires edit_others_posts (filterable via acui_capability ) and verifies the requested post’s post_type is acui_email_template , preventing a low-privilege 2.4.1
5. — Version 2.4 Security fix: added current_user_can('edit_user', $user_id) check before every wp_set_password() call during import, preventing a user with create_users access from resetting passwords of accounts they are not authorised 2.4
6. — Version 2.3.9 Fixed fatal error “array_intersect(): Argument #1 must be of type array, bool given” in async cron step 2+ when the roles_appeared transient had expired 2.3.9

25 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.9 Import and export users and customers < 2.4.3 - Authenticated (Admin+) Arbitrary File Read ↗
   2026-07-24 CVE-2025-15673 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 2.4.3 Patched in 2.4.3
2. Medium · 4.3 Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action ↗
   2026-07-09 CVE-2026-15026 Missing Authorization Affects <= 2.4.0 Patched in 2.4.1
3. High · 8.8 Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields ↗
   2026-05-01 CVE-2026-7641 Improper Privilege Management Affects <= 2.0.8 Patched in 2.0.9
4. High · 8.1 Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields ↗
   2026-03-21 CVE-2026-3629 Improper Privilege Management Affects <= 1.29.7 Patched in 2.0
5. Medium · 5.3 Import and export users and customers <= 1.27.12 - Unauthenticated Sensitive Information Disclosure ↗
   2025-01-27 CVE-2025-24689 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.27.12 Patched in 1.27.13
6. Medium · 4.4 Import and export users and customers <= 1.27.5 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-10-24 CVE-2024-50413 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.27.5 Patched in 1.27.6
7. Medium · 5.3 Import and export users and customers <= 1.26.8 - Unauthenticated Information Exposure ↗
   2024-08-07 CVE-2024-38787 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.26.8 Patched in 1.26.9
8. Medium · 4.4 Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-05-14 CVE-2024-4734 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.26.6.1 Patched in 1.26.7
9. Medium · 4.4 Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-05-14 CVE-2024-4656 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.26.6.1 Patched in 1.26.7
10. Medium · 4.3 Import and export users and customers <= 1.26.5 - Missing Authorization ↗
    2024-05-09 CVE-2024-34815 Missing Authorization Affects <= 1.26.5 Patched in 1.26.6
11. Medium · 4.3 Import and export users and customers <= 1.26.5 - Missing Authorization ↗
    2024-05-03 CVE-2024-1050 Missing Authorization Affects <= 1.26.5 Patched in 1.26.6
12. High · 7.2 Import and export users and customers <= 1.26.2 - Authenticated (Admin+) PHP Object Injection ↗
    2024-04-22 CVE-2024-32817 Deserialization of Untrusted Data Affects <= 1.26.2 Patched in 1.26.3
13. Medium · 5.3 Import and export users and customers <= 1.24.6 - Missing Authorization via fire_cron REST endpoint ↗
    2024-01-16 CVE-2024-22151 Missing Authorization Affects <= 1.24.6 Patched in 1.24.7
14. Medium · 4.9 Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2023-12-11 CVE-2023-6624 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.24.3 Patched in 1.24.4
15. Medium · 6.6 Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality ↗
    2023-12-08 CVE-2023-6583 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 1.24.2 Patched in 1.24.3
16. High · 8.0 Import and export users and customers <= 1.20.4 - Authenticated (Subscriber+) CSV Injection ↗
    2022-10-17 CVE-2022-3558 Improper Neutralization of Formula Elements in a CSV File Affects <= 1.20.4 Patched in 1.20.5
17. Medium · 5.5 Import and export users and customers <= 1.19.2 - Stored Cross-Site Scripting ↗
    2022-04-11 CVE-2022-1255 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.19.2.1 Patched in 1.19.2.1
18. High · 7.3 Import and export users and customers <= 1.16.3.5 - CSV injection via a customer's profile ↗
    2020-11-20 CVE-2020-22277 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects <= 1.16.3.5 Patched in 1.16.3.6
19. High · 7.7 Import and export users and customers 1.15 - Sensitive Data Exposure ↗
    2020-01-01 Improper Privilege Management Affects 1.15 Patched in 1.15.0.1
20. Medium · 6.3 Import and export users and customers <= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion & Path Traversal ↗
    2019-06-22 CVE-2019-14683 Cross-Site Request Forgery (CSRF) Affects <= 1.14.1.3 Patched in 1.14.2.2
21. High · 7.5 Import and export users and customers <= 1.14.2.1 - Directory Traversal ↗
    2019-06-20 CVE-2019-15326 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.14.2.1 Patched in 1.14.2.2
22. Medium · 6.1 Import and export users and customers <= 1.14.1.2 - Cross-Site Scripting ↗
    2019-06-20 CVE-2019-15327 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.14.1.2 Patched in 1.14.1.3
23. Medium · 6.1 Import and export users and customers <= 1.14.0.2 - Cross-Site Scripting ↗
    2019-03-14 CVE-2019-15328 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.14.0.3 Patched in 1.14.0.3
24. High · 8.8 Import and export users and customers <= 1.14.0.2 - Cross-Site Request Forgery ↗
    2019-03-14 CVE-2019-15329 Cross-Site Request Forgery (CSRF) Affects < 1.14.0.3 Patched in 1.14.0.3
25. Medium · 6.1 Import users from CSV with meta <= 1.12 - Import Cross-Site Scripting ↗
    2018-12-11 CVE-2018-20101 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.12.1 Patched in 1.12.1

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 14 languages, 2 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-04-15 80K+ → 70K+ down after 436 days in tier
2. 2025-02-03 70K+ → 80K+ up after 13 days in tier
3. 2025-01-21 80K+ → 70K+ down after 707 days in tier
4. 2023-02-14 70K+ → 80K+ up after 2 days in tier
5. 2023-02-12 80K+ → 70K+ down after 1 days in tier
6. 2023-02-11 70K+ → 80K+ up after 1 days in tier
7. 2023-02-10 80K+ → 70K+ down after 1 days in tier
8. 2023-02-09 70K+ → 80K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Import Users from CSV 10K+ installs · 4.0★ · 2 shared tags B
• WP All Export – User Export Add-On 2K+ installs · 3.8★ · 2 shared tags B
• Export Users Data CSV 1K+ installs · 4.2★ · 2 shared tags B
• LH Export Users to CSV 20+ installs · 4.0★ · 2 shared tags D
• W WorkflowPro Bulk Product CSV Importer — installs · 3.6★ · 2 shared tags C
• BadamSoft Product Importer for WooCommerce — installs · 3.6★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for Import and export users and customers into a readme, a review or a deck. It updates itself.

Import and export users and customers: 70K+ active installs, 4.7★ (256 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/import-users-from-csv-with-meta