Unauthorized Access in WP Import Plugin for WordPress

CVE-2025-12732

What is CVE-2025-12732?

The WP Import – Ultimate CSV XML Importer for WordPress contains a vulnerability that allows authenticated users with Author-level access or higher to access sensitive information due to a lack of proper authorization checks. Specifically, the missing validation in the showsetting() function can be exploited to retrieve confidential data such as OpenAI API keys stored within the plugin's administrative settings. This poses a significant risk to website security and user data integrity.

References