The vulnerability CVE-2024-34815 involves missing authorization controls in the Import and export users and customers plugin by Javier Carazo, specifically in the import-users-from-csv-with-meta functionality. This issue affects all versions up to and including 1.26.5. It allows users with low privileges to perform import/export actions that should require higher authorization, potentially leading to unauthorized data manipulation. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

The vulnerability allows unauthorized users with low privileges to perform import and export operations on user and customer data, which could lead to limited integrity and availability impacts. There is no confidentiality impact reported. This could result in unauthorized modification or disruption of user/customer data handled by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's import/export functionality to trusted users only and monitor for any unusual activity related to user or customer data import/export processes.