CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface.
Explanation of Vulnerability in Simple Terms
WP Ultimate CSV Importer versions 7.33 and earlier expose sensitive information to authenticated users. A logged-in user with low privileges can access data they should not be able to view. The plugin does not properly restrict access to certain information based on user role. Update to a version newer than 7.33 to resolve this issue.
What an attacker can do
Read sensitive data they should not have access to as a low-privilege user.
Potential impact on your site
Unauthorized users can view private or restricted information stored in the plugin.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges.
Key dates
External resources
