The vulnerability in the Import WP plugin allows an authenticated administrator to request arbitrary files on the server via the REST API endpoint. The plugin accepts absolute file paths without validation, meaning the local_url parameter can be set to any file system location. The attacker can read sensitive configuration files, credentials, or system files, compromising confidentiality.

The issue affects all installations of the Import WP – Export and Import CSV and XML files to WordPress plugin with versions 2.14.16 or earlier when running on WordPress sites. Any site using the vulnerable plugin and where an attacker can gain administrator privileges is at risk. The plugin is maintained by developer jcollings.

The CVSS score of 4.9 indicates moderate severity, with the EPSS score less than 1% suggesting that exploit attempts are currently rare. The vulnerability is listed as not in the CISA KEV catalog. An attacker must be authenticated with administrator or higher rights to trigger the REST API, limiting the attack surface to privileged accounts. However, once the condition is met, the attacker can read arbitrary files, which could lead to credential theft or other sensitive data exposure.