The WP Ultimate CSV Importer plugin allows an authenticated user with author-level permissions or higher to access the showsetting() endpoint without any authorization check, enabling the extraction of sensitive configuration data such as OpenAI API keys. This results in a direct loss of confidentiality for the site’s sensitive credentials.

Vendors: smackcoders. Product: WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress. Versions affected are all releases through 7.33 inclusive; any plugin version 7.33 or earlier is vulnerable.

The CVSS score of 4.3 indicates a moderate severity; however, the EPSS score of less than 1% shows the likelihood of real‑world exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated author or higher user accessing the showsetting() function via the plugin’s admin interface; the absence of an authorization check permits the attacker to retrieve sensitive configuration information.