A flaw in the Import and export users and customers plugin lets attackers write sensitive information into a file or directory that can be accessed from outside the WordPress installation. The exposed data can then be read by anyone who obtains a link to the file, resulting in a loss of confidentiality. This weakness matches CWE‑538, which describes the insertion of sensitive data into an externally accessible file or directory.

The vulnerability impacts the WordPress plugin "Import and export users and customers" produced by Javier Carazo, also known as import-users-from-csv-with-meta. Versions up to and including 1.27.12 are affected; no lower bound on the vulnerable range is specified.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of less than 1% shows that exploitation is currently considered unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need access to the plugin’s functionality—typically via the WordPress admin interface—to generate or download the vulnerable file, so the likely attack vector is remote through the web application.