The CVSS 7.5 rating for this WordPress plugin vulnerability obscures a more dangerous reality that neither severity scores nor EPSS fully capture. The bug allows unauthenticated access to export files containing your entire user table—email addresses, login names, and roles—provided two conditions align: an unconsumed export file exists, and the attacker obtains its low-entropy, time-based download key.
The key insight that changes your threat model: that first condition is not a stable barrier. These export files accumulate over time because the plugin does not implement automatic cleanup. Every admin who generates an export for any purpose creates a persistent artifact in your uploads directory, and the default WordPress plugin ecosystem provides no audit trail to track them. Your attack surface isn't bounded by the exports present at disclosure—it grows with each administrative action taken after patching.
The download key's 'low-entropy, time-based' description indicates it derives from a timestamp or similar predictable source, not cryptographic randomness. This makes it a candidate for brute-force enumeration within a time window rather than a truly secret value.
Prioritize these actions: First, audit your wp-content/uploads directory for any .csv or .xml export files from this plugin—delete anything you find. Second, verify your installation runs version 2.14.23 or later. Third, implement a recurring task to monitor for new export files in that directory, since the vulnerability's real severity depends on operational behavior the technical description cannot measure. The EPSS score of 0.00316 reflects low current exploitation, but this class of vulnerability sees opportunistic scanning once published—your forgotten exports are the variable that determines whether you become a statistic.