The WP Ultimate CSV Importer plugin for WordPress contains an authorization bypass vulnerability (CWE-200) due to the absence of an authorization check in the showsetting() function. Authenticated users with Author-level access or higher can exploit this flaw to retrieve sensitive information, including OpenAI API keys stored in the plugin's settings. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. No known exploits are reported in the wild, and no patch or remediation guidance is currently provided.

An attacker with Author-level or higher privileges on a WordPress site using the vulnerable plugin can access sensitive configuration data, including OpenAI API keys. This exposure could lead to unauthorized use of these keys, potentially resulting in abuse of associated services or data leakage. The vulnerability does not impact integrity or availability but compromises confidentiality of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor plugin updates from smackcoders for a security patch addressing this issue.