CVE-2025-12732

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface.

An attacker registers a free account on a WordPress site (or compromises an existing low-privilege contributor account). They craft a direct HTTP request to the vulnerable showsetting() endpoint — no special tooling required, just an authenticated session cookie. The endpoint returns admin plugin configuration including the plaintext OpenAI API key. The attacker then uses this key externally to run GPT-4 or DALL-E queries at the victim's expense, or resells the key on underground markets. A financially motivated adversary could systematically scan WordPress sites running this plugin, extract keys at scale, and run a cost-harvesting operation before the victim notices unusual billing.