Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-15507 Unauthenticated License Status Modification in Magic Import Document Extractor WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15507
Post summary
The entry reports CVE‑2025‑15507, describing an unauthenticated license status modification flaw in the Magic Import Document Extractor WordPress plugin, but provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2025-15507 The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage()… https://www.cve.org/CVERecord?id=CVE-2025-15507
Post summary
The Magic Import Document Extractor plugin for WordPress suffers from a missing capability check in ajax_sync_usage(), enabling unauthorized data modification (CVE-2025-15507).