The Comments Import & Export plugin for WordPress suffers from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) that enables path traversal attacks. Authenticated users with Author-level privileges or above can exploit insufficient file path validation during the comments import process to read arbitrary files on the server. This vulnerability affects all versions up to 2.3.7. Partial remediation was introduced in version 2.3.8, with a complete fix in 2.3.9. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacting confidentiality.

Successful exploitation allows an attacker with Author-level or higher privileges to read arbitrary files on the server, potentially exposing sensitive information. There is no impact on integrity or availability reported. The vulnerability does not require user interaction and can be exploited remotely over the network.

Users should upgrade the Comments Import & Export plugin to version 2.3.9 or later, where the vulnerability is fully fixed. Versions 2.3.8 and later include partial fixes but only 2.3.9 fully resolves the issue. No other mitigations are specified. Patch status is confirmed by the vendor's versioning information.