The Export and Import Users and Customers plugin for WordPress contains a path traversal vulnerability (CWE-22) in the download_file() function in versions up to 2.6.2. Authenticated attackers with Administrator-level access can exploit this flaw to read arbitrary log files on the server, potentially exposing sensitive data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.9 (Network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact). No patch or official fix has been documented in the provided data.

An attacker with Administrator-level access can leverage this vulnerability to read arbitrary log files on the server, which may contain sensitive information such as credentials, configuration details, or other private data. This compromises confidentiality but does not affect integrity or availability. Since exploitation requires high privileges, the risk is limited to trusted users who have already gained administrative access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted personnel only and monitor for suspicious activity. Consider disabling or removing the vulnerable plugin if possible to reduce exposure.