WP Import Ultimate CSV XML Importer for WordPress Missing Authorization Vulnerability in FTP SFTP Credential Access

A vulnerability exists in the WP Import – Ultimate CSV XML Importer for WordPress plugin, specifically in versions through 7.27. The issue arises from a missing capability check on the 'get_ftp_details' AJAX action, allowing authenticated attackers with Subscriber-level access and above to access sensitive SFTP/FTP credentials. The vulnerability was introduced in version 7.26 and persists in version 7.27.

Impact

Exploitation of this vulnerability allows for unauthorized access to FTP/SFTP credentials, which could be misused to access files or data on the server via these protocols.

Remediation

Users are advised to update the WP Import – Ultimate CSV XML Importer for WordPress plugin to version 7.28 or a newer patched version.