CVE-2025-15507: 
WordPress vulnerability analysis and mitigation

CVE-2025-15507 is a Missing Authorization vulnerability in the Magic Import Document Extractor plugin for WordPress. Due to a missing capability check on the ajax_sync_usage() function, unauthenticated attackers can modify the plugin's license status and credit balance. All versions up to and including 1.0.5 are affected (some sources cite up to 1.0.4). It was published on February 4, 2026, with Wordfence as the assigning CNA, and carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the ajax_sync_usage() AJAX function in the plugin's public class (public/class-public.php, line ~225) does not perform any capability or nonce check before processing requests. This allows any unauthenticated network attacker to invoke the function via a crafted HTTP request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php), directly manipulating the plugin's stored license status and credit balance. No authentication, privileges, or user interaction are required for exploitation (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to arbitrarily modify the plugin's license status and credit balance, which could result in service disruption (e.g., disabling licensed features), fraudulent manipulation of usage credits, or bypassing license enforcement. The impact is limited to integrity of plugin configuration data — there is no known confidentiality or availability impact — but it could undermine the operational integrity of sites relying on this plugin for document import functionality (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-15507. The EPSS score is approximately 0.051% (very low probability of exploitation in the near term). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and no user interaction, making it trivially exploitable by any remote attacker if the plugin is installed and active (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Magic Import Document Extractor plugin (versions ≤1.0.5) by scanning for plugin-specific files (e.g., /wp-content/plugins/magic-import-document-extractor/) or using tools like WPScan.
2. Identify the vulnerable AJAX action: Review the plugin source to confirm the AJAX action name registered by ajax_sync_usage() in public/class-public.php.
3. Craft the malicious request: Send an unauthenticated HTTP POST request to https://target-site.com/wp-admin/admin-ajax.php with the appropriate action parameter corresponding to the unprotected AJAX handler, along with desired license status or credit balance values in the POST body.
4. Achieve unauthorized modification: The server processes the request without any authentication or capability check, updating the plugin's stored license status and/or credit balance to attacker-controlled values (Wordfence, WordPress Trac).

• Network: Unexpected unauthenticated POST requests to /wp-admin/admin-ajax.php with the action parameter matching the ajax_sync_usage handler from unknown or suspicious IP addresses.
• Logs: WordPress access logs showing repeated POST requests to admin-ajax.php without a valid session cookie or nonce, particularly targeting the plugin's AJAX action.
• Database: Unexpected changes to plugin option values in the wp_options table related to Magic Import Document Extractor license status or credit balance fields.

Users should update the Magic Import Document Extractor plugin to a version beyond 1.0.5 (or 1.0.4 per some sources) that includes a proper capability check on the ajax_sync_usage() function. If an updated version is not yet available, site administrators should deactivate and remove the plugin until a patch is released. Additionally, web application firewalls (WAFs) can be configured to block unauthenticated POST requests to admin-ajax.php targeting this plugin's action (Wordfence).

Wordfence included CVE-2025-15507 in their weekly WordPress vulnerability report for February 2–8, 2026, noting it as a medium-severity missing authorization issue (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database aggregation has been observed.