CVE-2025-12732

Executive Summary

CVE-2025-12732 is a Missing Authorization vulnerability in the WordPress plugin WP Import – Ultimate CSV XML Importer (versions up to and including 7.33). This flaw allows authenticated attackers with Author-level access or higher to call the showsetting() function without proper authorization checks. The function exposes sensitive configuration data, including OpenAI API keys stored in the plugin’s admin interface.

This vulnerability is particularly dangerous in a WordPress ecosystem because it targets a widely-used data import plugin, and the exposed API keys can be leveraged for unauthorized access to external AI services, leading to financial loss and data breaches.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are not using modified or backdoored versions. The lack of a patch at the time of analysis means users must rely on manual mitigation.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (API keys exposed)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the exposure of API keys can lead to significant downstream impact, including unauthorized usage of paid AI services.

Deep Dive & Mechanics

The vulnerability resides in the showsetting() function of the WP Import plugin. This function is intended to retrieve and display plugin settings, including API keys for external services like OpenAI. The function is registered as an AJAX action, making it accessible via HTTP POST requests.

Root Cause: The function lacks a capability check (e.g., current_user_can('manage_options')) to verify that the requesting user has administrative privileges. WordPress’s AJAX handler only checks for user authentication, not authorization. As a result, any authenticated user with Author-level access or higher can trigger the function.

Attack Flow:

1. An attacker with Author-level credentials logs into the WordPress site.
2. The attacker sends a crafted AJAX request to wp-admin/admin-ajax.php with the action parameter set to the vulnerable function.
3. The showsetting() function executes and returns the plugin’s settings, including the OpenAI API key.
4. The attacker extracts the API key and uses it to make unauthorized API calls to OpenAI, incurring costs or accessing restricted AI models.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.33):

add_action('wp_ajax_showsetting', 'showsetting');
function showsetting() {
    // No authorization check
    $settings = get_option('wp_import_settings');
    echo json_encode($settings);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_showsetting', 'showsetting');
function showsetting() {
    // Added authorization check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $settings = get_option('wp_import_settings');
    echo json_encode($settings);
    wp_die();
}

The patch adds a current_user_can('manage_options') check to ensure only administrators can access the settings.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Import plugin <= 7.33 installed and activated.
• Valid Author-level credentials (username and password).

Exploitation Steps:

1. Log in to WordPress as an Author.
2. Open browser developer tools (F12) and navigate to the Console tab.
3. Execute the following JavaScript to send the AJAX request:

   jQuery.post(ajaxurl, {
       action: 'showsetting'
   }, function(response) {
       console.log(response);
   });
   

4. The response will contain the plugin settings, including the OpenAI API key.

Alternative using cURL:

curl -X POST \
  -c cookies.txt \
  -b cookies.txt \
  -d "action=showsetting" \
  "https://target-site.com/wp-admin/admin-ajax.php"

Blue Team (Detection & Response)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with the action parameter set to showsetting.
2. Alert on any such requests from users with roles below Administrator.
3. Review server logs for unusual API calls to OpenAI endpoints from the WordPress server IP.

Response:

1. Immediately revoke the exposed API key from the OpenAI dashboard.
2. Rotate all API keys stored in the plugin.
3. Restrict user roles to the minimum necessary (e.g., remove Author-level access if not needed).
4. Apply the patch as soon as it becomes available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=showsetting.
  • Outbound API calls to api.openai.com from the WordPress server IP, especially if the API key was not previously used.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/wp-import-ultimate-csv-importer/.
  • Suspicious log entries in /var/log/apache2/access.log or /var/log/nginx/access.log showing repeated AJAX requests.

• User IOCs:

  • Unusual activity from Author-level accounts, such as accessing admin-ajax.php directly.

Detection Engineering

YARA Rule

rule CVE_2025_12732_WP_Import_Unauthorized_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12732 in WP Import plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12732"
    strings:
        $ajax_action = "action=showsetting"
        $wp_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $wp_ajax
}

Sigma Rule

title: CVE-2025-12732 WP Import Unauthorized AJAX Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized access to the showsetting AJAX action in WP Import plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=showsetting'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12732 WP Import Unauthorized AJAX Access"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=showsetting"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Revoke any exposed API keys (e.g., OpenAI) and generate new ones.
3. Audit user roles and remove Author-level access from users who do not require it.
4. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=showsetting from non-admin users.

Long-term Fix:

• Apply the official patch from the plugin vendor once released.
• If no patch is available, manually add the authorization check to the plugin code (see patched code example above).

Monitoring:

• Enable logging for all AJAX requests.
• Set up alerts for any outbound API calls to OpenAI or other external services from the WordPress server.

Report generated by Valters IT DevSecOps Intelligence Unit.