WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection
Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.

