This vulnerability, identified as CVE-2024-32817, affects the Import and export users and customers plugin by Javier Carazo, versions up to and including 1.26.2. It involves deserialization of untrusted data, which can lead to partial compromise of confidentiality and integrity. The CVSS 3.1 base score is 4.4, reflecting a medium severity with attack vector network, high attack complexity, and requiring high privileges without user interaction. The vulnerability is published and tracked but lacks a known patch or vendor advisory at this time.

An attacker with high privileges on the affected system could exploit this vulnerability to manipulate deserialized data, potentially leading to partial disclosure or modification of sensitive information. There is no impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to trusted users only and monitor for unusual activity related to import/export functionality. Avoid importing untrusted data where possible.