The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 2.14.17. The flaw is caused by the import/export functionality and a lack of .htaccess protection, enabling unauthenticated attackers to read sensitive data from exports stored in /exportwp and import data in /importwp. This weakness corresponds to CWE-552, which denotes sensitive data exposure.

The affected product is the Import WP – Export and Import CSV and XML files to WordPress plugin, developed by jcollings. All releases of the plugin through version 2.14.17 are impacted. Users of newer releases are presumed unaffected unless the vendor acknowledges otherwise.

The CVSS score of 5.3 indicates a moderate threat, while the EPSS score of less than 1% suggests low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can likely trigger the exposure by calling the import or export endpoints or accessing the publicly exposed directories, as the plugin does not enforce authentication or directory protection. Without .htaccess protection, any visitor can read files under /exportwp and /importwp, leading to the disclosure of potentially confidential WordPress content.