Unauthorized Data Access in WP Import Ultimate CSV XML Importer Plugin by WordPress
CVE-2025-10040
7.7HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 10 September 2025
What is CVE-2025-10040?
The WP Import – Ultimate CSV XML Importer for WordPress is exposed to a significant vulnerability due to inadequate capability checks on the 'get_ftp_details' AJAX action. This issue affects all versions up to and including 7.27, allowing authenticated users with Subscriber-level permissions or higher to access sensitive SFTP/FTP credentials. This could lead to unauthorized disclosure of critical data, posing risks for website security and user privacy.
Affected Version(s)
WP Import – Ultimate CSV XML Importer for WordPress * <= 7.27