Import WP WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the Import WP – Export and Import CSV and XML files to WordPress plugin, in all versions through 2.14.17. The issue arises from the import/export functionality and the absence of proper .htaccess protection, enabling unauthenticated attackers to access sensitive data from exports stored in the /exportwp directory and import data into the /importwp directory.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, such as debug log files, session data, and export files.

Remediation

Users can update to version 2.14.18 or a newer patched version to address this vulnerability.