CVE-2025-15508 — Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_setting…
Published: 2026-02-04 · CVSS: 5.3 · CVSS 3.1
The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function. This makes it possible for unauthenticated attackers to extract the site's magicimport.ai license key from the page source on any page containing the plugin's shortcode.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7