CVE-2025-12732

Name of the Vulnerable Software and Affected Versions WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.34

Description The WP Import – Ultimate CSV XML Importer for WordPress plugin contains a flaw that allows unauthorized access to sensitive information. This is due to a missing authorization check within the showsetting() function. Attackers with Author-level access or higher can extract sensitive information, including OpenAI API keys configured through the plugin’s admin interface.

Recommendations Update to version 7.34 or later. As a temporary workaround, consider restricting access for users with Author-level access or higher to minimize the risk of exploitation.