Import and export users and customers < 1.24.3 - Admin+ Arbitrary File Read/Deletion

Description

The plugin is vulnerable to Directory Traversal via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.