CVE-2024-13562 is a vulnerability in the Import WP – Export and Import CSV and XML files to WordPress plugin affecting all versions up to and including 2.14.5. It allows unauthenticated attackers to retrieve sensitive data stored in the uploads directory (/wp-content/uploads/) due to improper access controls. The vulnerability results in exposure of potentially sensitive user data and files without requiring authentication. The CVSS 3.1 score of 7.5 reflects a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality but not integrity or availability.

An attacker can access sensitive information stored insecurely in the uploads directory of the affected WordPress plugin without authentication. This exposure could lead to unauthorized disclosure of imported or local user data and files. There is no indication of impact on data integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /wp-content/uploads/ directory through web server configuration or other access control mechanisms to prevent unauthorized data exposure. Monitor vendor channels for updates regarding a patch or official mitigation.