Vulnerability · Published Feb 4, 2026 · Assigned by Wordfence

CVE-2025-15508Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure

Medium 5.3

In plain English

A medium-severity information exposure in Magic Import Document Extractor from magicimport. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function. This makes it possible for unauthenticated attackers to extract the site's magicimport.ai license key from the page source on any page containing the plugin's shortcode.

Affected products (as reported)

Vendor	Product	Versions
magicimport	Magic Import Document Extractor	0 – through 1.0.6

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References