The Import WP plugin for WordPress suffers from an arbitrary file read vulnerability (CWE-73) due to insufficient validation of absolute file paths in its REST API endpoint. Specifically, the 'attach_file()' function accepts a 'local_url' parameter that can be manipulated by authenticated administrators to read any file on the server filesystem. This affects all versions up to 2.14.16. The CVSS 3.1 base score is 4.9, reflecting medium severity with network attack vector, low attack complexity, and high privileges required. No known exploits are reported in the wild. No patch or official remediation guidance is currently available.

An attacker with administrator-level access can read arbitrary files on the server hosting the WordPress plugin. This could lead to disclosure of sensitive information such as configuration files or system data. The vulnerability does not allow code execution or denial of service, but unauthorized file disclosure can aid further attacks or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for unusual activity. Avoid exposing the vulnerable REST API endpoint if possible. Apply updates promptly once a vendor patch becomes available.