Magicimport vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Magicimport products: 2 record(s), with severity, exploitation and fixes.

Magic Import Document Extractor 2

Exploited only (KEV) →

CVE-2025-15508 Medium · 5.3 CWE-200 Feb 4, 2026

Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure

The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function. This makes it possible for unauthenticated attackers to extract the site's magicimport.ai license key from the page source on any page containing the plugin's shortcode.

CVE-2025-15507 Medium · 5.3 CWE-862 Feb 4, 2026

Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification

The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.