WP Import - Ultimate CSV XML Importer for WordPress Missing Authorization Vulnerability Allowing Sensitive Information Exposure

A vulnerability exists in the WP Import - Ultimate CSV XML Importer for WordPress plugin, in all versions through 7.33, due to a missing authorization check in the showsetting() function. This flaw allows authenticated attackers with Author-level access or higher to access sensitive information, such as OpenAI API keys, through the plugin's admin interface.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, specifically OpenAI API keys, for authenticated users with Author-level access or higher.

Remediation

Users can update to version 7.33.1 or a newer patched version to address this vulnerability.