A Missing Authorization flaw in the WebToffee Comments Import & Export plugin allows exploitation of incorrectly configured access control security levels. This flaw lets an attacker trigger the plugin’s import or export functions without the required authorization, potentially giving unauthorized access to comment data and the ability to import potentially malicious data.

WordPress sites that include the WebToffee Comments Import & Export plugin in any version up to and including 2.4.9 are affected. The issue is present in all releases preceding that version, regardless of the hosting environment.

The vulnerability carries a CVSS score of 7.7, indicating high severity, but the EPSS score is below 1%, suggesting a low current exploitation probability. It is not listed in CISA's KEV catalog. The likely attack vector is a web‑based exploitation of the plugin’s import/export endpoints that lack proper authentication checks. Attackers could target these endpoints from any authenticated user or even from an unauthenticated visitor if the site allows the plugin to be accessed before login.