Vulnerabilities

TI-2025-14147 CVE-2025-15508 · GHSA-4pwg-7vwv-m825

Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure

LOW 30

The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00337 Published 2026-02-04 No fix listed CWE-200

TI-2025-14146 CVE-2025-15507 · GHSA-jjh4-mw9m-8pvg

Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification

LOW 30

The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0034 Published 2026-02-04 No fix listed CWE-862

Vulnerabilities

Filters

Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure

Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification