The WordPress plugin WP Ultimate CSV Importer fails to enforce a capability check on the AJAX action ‘get_ftp_details’. As a result, any authenticated user with the Subscriber role or higher can retrieve a stored set of SFTP/FTP credentials. The flaw is a missing authorization issue (CWE‑862) that allows the attacker to read credentials that were meant to be protected. This exposure permits the attacker to gain access to external storage systems, potentially leading to further compromise on the target environment.

The vulnerability applies to the plugin ‘WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress’ released by smackcoders, affecting all versions up to and including 7.27. Any WordPress site that has installed one of these versions and allows Subscriber‑level users to authenticate is at risk.

The CVSS score of 7.7 indicates a high impact with moderate exploitation difficulty. The EPSS score of less than 1% points to a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attacker requires only authenticated access, which is trivial for a site with many subscribers; however, gaining the stored FTP/SFTP credentials can lead to a complete compromise of remote host access and data exfiltration.