The Export and Import Users and Customers plugin, used within WordPress, contains a directory traversal flaw in the download_file() function. This weakness (CWE‑22) allows an attacker who has authenticated Administrator or higher privileges to read the contents of any file on the server by crafting a path traversal request. The plugin could expose log files that may hold sensitive data, therefore compromising confidentiality of those files.

All WordPress sites that have the Webtoffee Export and Import Users and Customers plugin installed on version 2.6.2 or earlier. The vulnerability is specifically tied to the plugin provided by Webtoffee and is relevant to WordPress installations that include this plugin.

The CVSS score for this issue is 4.9, indicating moderate severity. The EPSS score of less than 1% reflects a very low but non‑zero probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authorized Administrator or higher account, meaning the danger arises from credential compromise or mis‑assigned privileges rather than from direct unauthenticated access.