The vulnerability in the WordPress WP Ultimate CSV Importer plugin allows an attacker to retrieve sensitive data embedded within the import payload. This can lead to disclosure of confidential information such as credentials, tokens, or personal user data, compromising the privacy and integrity of the site. The weakness is classified as CWE‑201, indicating a flaw that permits the extraction of sensitive information from sent data.

All WordPress sites that use the WP Ultimate CSV Importer plugin version 9.1 or earlier are affected. The plugin, provided by Smackcoders Inc., is commonly used to import CSV files, and any installation using a vulnerable version is at risk.

The CVSS score of 5.3 indicates a medium severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The attacker must be able to trigger the import functionality, suggesting that the vulnerability is exploitable by authenticated users or through prompted actions. While the exact attack vector is not detailed, the impact remains significant due to the potential leakage of confidential data.