The vulnerability resides in the get_frontend_settings() function of the Magic Import Document Extractor WordPress plugin, allowing unauthenticated users to view the site's magicimport.ai license key. Exposure of this key can provide attackers with proprietary authentication credentials, potentially enabling further compromise of the host or access to licensed services. The weakness is a classical information disclosure flaw (CWE-200).

The affected product is Magic Import Document Extractor from the vendor magicimport. All released versions up to and including 1.0.4 are vulnerable, as the plugin does not perform any authentication checks when rendering the front‑end settings on pages that contain its shortcode.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated, simply by visiting any publicly accessible page that embeds the plugin’s shortcode and viewing the page source to locate the leaked license key. An attacker can obtain the key without any special privileges or interaction beyond access to the site.