CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through <= 1.27.12.
Explanation of Vulnerability in Simple Terms
The Import and export users and customers plugin for WordPress contains a flaw that allows an attacker to read sensitive data without authentication. The vulnerability requires specific conditions to exploit but does not require user interaction. Affected versions are 1.27.12 and earlier. Site administrators should update to a version newer than 1.27.12.
What an attacker can do
Read sensitive data from the site without logging in.
Potential impact on your site
Sensitive user or customer data may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the site; specific attack conditions must be met.
Key dates
External resources
Related vulnerabilities
