CVE-2025-15507
Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.
| CWE | CWE-862 |
| Vendor | magicimport |
| Product | magic import document extractor |
| Published | Feb 4, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for magicimport magic import document extractor
Be the first to know when new medium vulnerabilities affecting magicimport magic import document extractor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
magicimport / Magic Import Document Extractor
0 ≤ 1.0.5
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/6854e470-26ac-4747-b72c-164e79e1a1b1?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/magic-import-document-extractor/tags/1.0.4/public/class-public.php#L225 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3452549/
Credits
Teerachai Somprasong