CVE-2025-15508: 
WordPress vulnerability analysis and mitigation

CVE-2025-15508 is a Sensitive Information Exposure vulnerability in the Magic Import Document Extractor plugin for WordPress, affecting all versions up to and including 1.0.4. The flaw allows unauthenticated attackers to extract the site's magicimport.ai API license key directly from the page source on any page that renders the plugin's shortcode. It was published on February 4, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerable get_frontend_settings() function in public/class-public.php (line 379) outputs the site's magicimport.ai license key as part of the plugin's frontend settings rendered into the HTML page source when the plugin's shortcode is present. Because no authentication or capability check is enforced before this data is exposed, any unauthenticated network attacker can retrieve the key simply by viewing the page source of any affected page. No special tools, credentials, or complex conditions are required (Wordfence, WordPress Trac).

Successful exploitation results in the disclosure of the site's magicimport.ai API license key to any unauthenticated attacker. An exposed license key could be abused to consume the site owner's API quota, incur financial charges, or access magicimport.ai services under the victim's account. There is no direct integrity or availability impact, and lateral movement within the WordPress installation itself is not directly enabled by this vulnerability alone (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication and minimal technical skill — simply viewing the HTML source of a page with the plugin's shortcode is sufficient (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Magic Import Document Extractor plugin (versions ≤ 1.0.4) by searching for plugin-specific indicators (e.g., using Google dorks for the plugin's shortcode or scanning with WPScan).
2. Locate a shortcode page: Browse the target WordPress site to find any page or post that renders the plugin's shortcode (e.g., a document import or extraction page).
3. View page source: Open the page in a browser and view the HTML source (Ctrl+U), or use a tool like curl to fetch the raw HTML: curl -s https://target-site.com/page-with-shortcode/ | grep -i 'license'.
4. Extract the license key: Locate the magicimport.ai license key embedded in the frontend settings output by the get_frontend_settings() function within the page source.
5. Abuse the key: Use the extracted license key to authenticate against the magicimport.ai API, consuming the victim's quota or accessing their account (Wordfence, WordPress Trac).

• Network: Unusual or repeated HTTP GET requests to pages containing the Magic Import Document Extractor shortcode from unknown or automated IP addresses, particularly with no referrer or user-agent strings consistent with bots.
• Logs: Web server access logs showing high-frequency requests to shortcode-enabled pages from a single IP or range, potentially with curl or scripted user-agent strings.
• API Usage: Unexpected spikes in magicimport.ai API usage or billing alerts that do not correspond to legitimate site activity, which may indicate the license key is being used externally.

WordPress site administrators should update the Magic Import Document Extractor plugin to version 1.0.5 or later, which addresses this vulnerability by removing the license key from frontend output. As an interim workaround, administrators can deactivate or remove the plugin until the update can be applied. If the license key has already been exposed, it should be regenerated or revoked via the magicimport.ai account dashboard (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of February 2–8, 2026, noting the patch availability in version 1.0.5 (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.