CVE-2025-1971 is a PHP Object Injection vulnerability in the webtoffee Export and Import Users and Customers WordPress plugin (up to version 2.6.2). It arises from unsafe deserialization of untrusted input via the 'form_data' parameter. The vulnerability requires authenticated users with Administrator privileges. Exploitation potential depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes, which could enable file deletion, data disclosure, or code execution. No POP chain is present in the vulnerable plugin itself.

An attacker with Administrator-level access can inject PHP objects via deserialization. However, the vulnerability alone does not allow exploitation unless a POP chain is available through other plugins or themes. If such a chain exists, the attacker could perform high-impact actions including arbitrary file deletion, sensitive data retrieval, or remote code execution. The CVSS score of 7.2 reflects the high impact potential under these conditions.

No patch information is provided; patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires Administrator access and a POP chain in other components, review and update all plugins and themes to versions without POP chains. Limit Administrator access to trusted users only. Monitor vendor channels for an official fix or update to the Export and Import Users and Customers plugin.