CVE-2025-10040 is a missing authorization vulnerability (CWE-862) in the WP Ultimate CSV Importer plugin for WordPress. The plugin fails to enforce capability checks on the 'get_ftp_details' AJAX action, enabling authenticated users with low privileges (Subscriber and above) to access sensitive FTP/SFTP credentials configured in the plugin. This vulnerability affects all versions up to 7.27. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact.

An attacker with at least Subscriber-level access to a vulnerable WordPress site can retrieve stored FTP/SFTP credentials. This exposure of sensitive credentials could lead to further compromise of the website or server if the credentials are reused or provide elevated access. The confidentiality of the FTP/SFTP credentials is fully impacted, but integrity and availability are not directly affected by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity. Avoid granting Subscriber or higher privileges to untrusted users. Review and rotate FTP/SFTP credentials if unauthorized access is suspected.