CVE-2024-12637 is a sensitive information exposure vulnerability in the Moving Users WordPress plugin (versions up to 1.05). The plugin's export feature stores JSON files containing user data in predictable, guessable locations. Because these files are accessible without authentication, an attacker can retrieve sensitive information including email addresses, hashed passwords, and IP addresses. This issue arises from improper access control and predictable file storage paths, leading to unauthorized data disclosure.

An unauthenticated attacker can access sensitive user information such as email addresses, hashed passwords, and IP addresses by guessing the location and filenames of exported JSON files. This exposure could lead to privacy violations and potentially facilitate further attacks if the hashed passwords are weak or reused elsewhere. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict access to the export functionality and the directories where exported JSON files are stored, for example by using web server access controls or disabling the export feature if possible. Monitor official vendor channels for updates or patches addressing this vulnerability.