{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10040", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-05T17:40:07.006Z", "datePublished": "2025-09-10T06:38:49.153Z", "dateUpdated": "2026-04-08T17:11:19.923Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:19.923Z"}, "affected": [{"vendor": "smackcoders", "product": "WP Ultimate CSV Importer \u2013 Import CSV, XML & Excel into WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.27", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials."}], "title": "WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcdcaa4-c492-4d79-8d18-44802abd02e7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.26/uploadModules/FtpUpload.php#L231"}, {"url": "https://plugins.trac.wordpress.org/changeset/3357936/wp-ultimate-csv-importer/trunk/uploadModules/FtpUpload.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "timeline": [{"time": "2025-09-05T17:55:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-09T17:59:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T20:30:43.299727Z", "id": "CVE-2025-10040", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:30:53.265Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10040", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T20:30:43.299727Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:30:47.400Z"}}], "cna": {"title": "WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "affected": [{"vendor": "smackcoders", "product": "WP Import \u2013 Ultimate CSV XML Importer for WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "7.27"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-05T17:55:16.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-09T17:59:47.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcdcaa4-c492-4d79-8d18-44802abd02e7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.26/uploadModules/FtpUpload.php#L231"}, {"url": "https://plugins.trac.wordpress.org/changeset/3357936/wp-ultimate-csv-importer/trunk/uploadModules/FtpUpload.php"}], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-10T06:38:49.153Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10040", "state": "PUBLISHED", "dateUpdated": "2025-09-10T20:30:53.265Z", "dateReserved": "2025-09-05T17:40:07.006Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-10T06:38:49.153Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials."}], "id": "CVE-2025-10040", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-10T07:15:43.660", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.26/uploadModules/FtpUpload.php#L231"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3357936/wp-ultimate-csv-importer/trunk/uploadModules/FtpUpload.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcdcaa4-c492-4d79-8d18-44802abd02e7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:23:18.469689+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Ultimate CSV Importer plugin to version 7.28 or later, which includes the missing capability check for the \u2018get_ftp_details\u2019 action.", "If an immediate upgrade is not feasible, remove or downgrade the Subscriber role\u2019s access to the plugin\u2019s AJAX endpoint, for example by adjusting the role capabilities in WordPress or using a role\u2011editing plugin.", "After remediation, review and reset any exposed FTP/SFTP credentials and monitor access logs for unusual calls to the \u2018get_ftp_details\u2019 action."], "summary": {"action": "Patch immediately", "impact": "Credential Exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to the plugin \u2018WP Ultimate CSV Importer \u2013 Import CSV, XML & Excel into WordPress\u2019 released by smackcoders, affecting all versions up to and including 7.27. Any WordPress site that has installed one of these versions and allows Subscriber\u2011level users to authenticate is at risk.", "description_and_impact": "The WordPress plugin WP Ultimate CSV Importer fails to enforce a capability check on the AJAX action \u2018get_ftp_details\u2019. As a result, any authenticated user with the Subscriber role or higher can retrieve a stored set of SFTP/FTP credentials. The flaw is a missing authorization issue (CWE\u2011862) that allows the attacker to read credentials that were meant to be protected. This exposure permits the attacker to gain access to external storage systems, potentially leading to further compromise on the target environment.", "risk_and_exploitability": "The CVSS score of 7.7 indicates a high impact with moderate exploitation difficulty. The EPSS score of less than 1% points to a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attacker requires only authenticated access, which is trivial for a site with many subscribers; however, gaining the stored FTP/SFTP credentials can lead to a complete compromise of remote host access and data exfiltration."}}}}, "created": "2026-04-22T13:30:17.923764+00:00", "updated": "2026-04-22T13:30:17.923782+00:00", "vendors": []}