The Magic Export & Import WordPress plugin before version 1.2.0 stores exported CSV files in a publicly accessible folder, which allows any visitor to download files containing sensitive user personal information. The vulnerability is a direct result of storing context‑sensitive data without proper access restrictions, leading to disclosure of personally identifying information. Attackers can obtain these files simply by accessing the URL where the CSV is stored.

Any WordPress site that runs the Magic Export & Import plugin version 1.1.x or earlier is affected. The plugin’s export mechanism has been altered in version 1.2.0 to secure the location of exported files, so only installations using older releases remain vulnerable.

Because the exported CSV files are served from a public endpoint, the attack vector is straightforward: an unauthenticated HTTP GET on the file path will return the data. The EPSS score is < 1% and the CVSS score is 5.3, and the vulnerability is not listed in the CISA KEV catalog, indicating that no large‑scale exploitation has yet been observed. Nevertheless, the lack of authentication or authorization checks makes exploitation trivial, and the risk of exposing personal data remains high whenever such files are present.