The Import WP plugin for WordPress, in versions prior to 2.14.23, does not enforce authorization on one of its export-file download handlers. This allows unauthenticated attackers to access export files created by administrators without permission. These export files may include sensitive user information like email addresses, login names, and roles. Successful exploitation depends on the presence of an unconsumed export file and the attacker obtaining a low-entropy, time-based download key. No CVSS score or vendor advisory is available, and no patch or remediation information has been provided.

Unauthorized disclosure of user personal data including email addresses, login names, and roles. This exposure could lead to privacy violations and facilitate further attacks such as phishing or targeted social engineering. The vulnerability requires specific conditions to be exploitable, including an existing export file and knowledge of a time-based download key.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to export files and monitor for unauthorized downloads. Avoid generating export files unnecessarily and delete unconsumed exports promptly to reduce exposure risk.