CVE-2025-15507: WordPress Magic Import Auth Bypass Flaw

CVE-2025-15507 Overview

CVE-2025-15507 affects the Magic Import Document Extractor plugin for WordPress in all versions up to and including 1.0.5. The plugin exposes an AJAX endpoint backed by the ajax_sync_usage() function that lacks a capability check. Unauthenticated attackers can invoke this endpoint to modify the plugin's license status and credit balance. The flaw is categorized as Missing Authorization [CWE-862] and is reachable over the network without user interaction.

Critical Impact
Unauthenticated attackers can tamper with plugin license status and credit balance on affected WordPress sites.

Affected Products

Magic Import Document Extractor plugin for WordPress, versions ≤ 1.0.5
WordPress sites with the plugin installed and active
Patched in plugin release referenced by changeset 3452549

Discovery Timeline

2026-02-04 - CVE-2025-15507 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-15507

Vulnerability Analysis

The Magic Import Document Extractor plugin registers an AJAX action handled by the ajax_sync_usage() function in public/class-public.php. The handler is exposed through WordPress's wp_ajax_nopriv_ mechanism, meaning unauthenticated visitors can reach it. The function processes requests that update internal plugin state, specifically the stored license status and credit balance, but does not call current_user_can() or validate a nonce in a way that enforces authorization.

Because the endpoint accepts requests from anonymous users and writes to plugin options, attackers can issue crafted POST requests to manipulate licensing state. The integrity impact is limited to plugin-managed values rather than full site compromise, which aligns with the partial integrity rating in the CVSS vector. Confidentiality and availability are not directly affected.

Root Cause

The root cause is a missing capability check on a state-changing AJAX handler. WordPress plugin authors must gate privileged actions with both a capability verification and nonce validation. In this plugin, the synchronization routine was registered for unauthenticated access without these controls, allowing any caller to alter persisted plugin data.

Attack Vector

An attacker sends an HTTP POST request to /wp-admin/admin-ajax.php on a target site with the vulnerable plugin installed. The request specifies the plugin's sync action and the values to write. No credentials, tokens, or user interaction are required. See the WordPress Plugin Class Code for the vulnerable function and the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2025-15507

Indicators of Compromise

Unexpected changes to the Magic Import Document Extractor plugin's license status or credit balance stored in wp_options
POST requests to /wp-admin/admin-ajax.php invoking the plugin's sync action from unauthenticated sources
Web server logs showing repeated admin-ajax.php requests referencing the plugin's action name without authenticated session cookies

Detection Strategies

Review WordPress access logs for anonymous admin-ajax.php requests targeting the plugin's AJAX action
Compare current plugin option values against known-good baselines to detect unauthorized modification
Alert on AJAX requests to the plugin endpoint that lack a valid logged-in user cookie

Monitoring Recommendations

Track changes to WordPress options associated with the plugin using file integrity and database monitoring
Enable WordPress audit logging plugins to record administrative state changes
Forward web server and WordPress logs to a centralized SIEM for correlation against external scanning patterns

How to Mitigate CVE-2025-15507

Immediate Actions Required

Update the Magic Import Document Extractor plugin to a version newer than 1.0.5 once available from the WordPress plugin repository
Deactivate the plugin if a fixed version is not yet installed and the functionality is not required
Audit plugin license and credit values for unauthorized modifications and restore correct settings

Patch Information

The vendor committed a fix in WordPress plugin changeset 3452549. Site administrators should apply the update through the WordPress admin dashboard or by deploying the patched plugin files. Review the WordPress Changeset Update for the specific code changes addressing the missing capability check.

Workarounds

Block unauthenticated POST requests to /wp-admin/admin-ajax.php targeting the plugin's action via a web application firewall (WAF) rule
Restrict access to admin-ajax.php from untrusted networks where feasible
Remove the plugin until a patched release is verified in the affected environment

bash

# Example WAF rule concept to block the vulnerable AJAX action for unauthenticated users
# (adapt to your WAF syntax)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1015507,msg:'Block CVE-2025-15507 sync action'"
SecRule ARGS:action "@streq magic_import_sync_usage" \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"