Unauthorized Access in WP Import Plugin for WordPress

CVE-2025-12732

What is CVE-2025-12732?

The WP Import – Ultimate CSV XML Importer for WordPress contains a vulnerability that allows authenticated users with Author-level access or higher to access sensitive information due to a lack of proper authorization checks. Specifically, the missing validation in the showsetting() function can be exploited to retrieve confidential data such as OpenAI API keys stored within the plugin's administrative settings. This poses a significant risk to website security and user data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References