{"data":{"id":"2f32902b-62df-48e6-9616-f13a1fc260e7","title":"CVE-2025-12732: The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of…","summary":"CVE-2025-12732 affects the WP Import – Ultimate CSV XML Importer for WordPress plugin in all versions up to and including 7.33. A missing authorization check on the showsetting() function exposes sensitive information, including OpenAI API keys configured through the plugin's admin interface. Authenticated attackers with Author-level access or higher can extract these keys.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-12732","publishedAt":"2025-11-12T14:15:40.573Z","cveId":"CVE-2025-12732","cweIds":["CWE-200"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI API keys","WP Import – Ultimate CSV XML Importer for WordPress"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"WP Import Ultimate CSV XML Importer for WordPress missing authorization","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00277,"epssCheckedAt":"2026-11-04T06:10:13.536Z","kevDateAdded":null,"advisoryAliases":["GHSA-7vx4-9vv7-7745"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:32.376Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}