Administrator file disclosure via unrestricted import path

Path traversal in Codection Import and export users and customers before 2.4.3 allows remote authenticated users to read server files. The manual CSV importer's path_to_file field accepts an unrestricted local path and displays that file instead of confining reads to CSV files in the uploads directory. Administrator access to the WordPress Tools importer is required, and exposed files can include configuration data, logs, or other server-readable content.