This vulnerability involves the insertion of sensitive information into files or directories that are accessible externally within the Javier Carazo Import and export users and customers plugin, specifically in the import-users-from-csv-with-meta functionality. The affected versions are up to and including 1.27.12. The CVSS score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact. No patch or remediation information is currently provided.

Successful exploitation could lead to unauthorized retrieval of embedded sensitive data due to exposure in externally accessible files or directories. This compromises confidentiality but does not affect integrity or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to affected files or directories if possible. Monitor for updates from the vendor regarding patches or official mitigations.