CVE-2025-12894 affects the Import WP – Export and Import CSV and XML files to WordPress plugin by jcollings. The vulnerability arises from insufficient access controls on directories used to store exported and imported data files (/exportwp and /importwp). Without .htaccess protection, these directories are accessible to unauthenticated attackers, leading to sensitive information exposure. The issue impacts all plugin versions up to and including 2.14.17. No patch or official fix information is provided in the available data.

An unauthenticated attacker can access sensitive data stored in the export and import directories of the plugin, potentially exposing confidential information contained in CSV or XML files. The vulnerability does not affect integrity or availability but compromises confidentiality. The CVSS score of 5.3 reflects a medium impact due to the ease of access and the sensitivity of the exposed data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should manually restrict access to the /exportwp and /importwp directories, for example by adding appropriate .htaccess rules or server-level access controls to prevent unauthorized external access. Monitoring for updates from the vendor is recommended to apply any forthcoming patches.