MLS Import < 7.0.4 Authenticated Sensitive Information Disclosure via Missing CSRF Check (CVE-2026-17515)

Vulnerability Overview Vulnerability Name: MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item Description: The plugin lacks authorization and CSRF checks in one of its AJAX operations, allowing any authenticated user (such as Subscribers) to read the plugin's import log file contents as well as import-related metadata belonging to arbitrary posts. CVE Number: CVE-2026-17515 Classification: - Type: Sensitive Data Exposure - OWASP Top 10: A3: Sensitive Data Exposure - CWE: CWE-200 - CVSS: 4.3 (Medium) Affected Versions Affected Plugin: mlsimport Fixed Version: 7.0.4 Remediation Remediation: Upgrade to version 7.0.4 or later. Timeline Public Disclosure Date: 2026-07-29 Added Date: 2026-07-29 Last Updated: 2026-07-29 Additional Information Original Researcher: Shikhal Jamalzade Submitter: Shikhal Jamalzade Submitter Website: https://allsalive.medium.com Submitter Twitter: 0xAlisAlive Verification Status: Verified WPVDB ID: 8c8da95c-df83-4788-bcb2-ca924a60f909 Related Vulnerabilities 2026-04-27: Templatey – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! < 3.6.2 - Authenticated (Contributor+) Information Exposure 2025-12-25: Custom Related Posts < 1.8.1 - Unauthenticated Information Exposure 2025-02-28: GenerateBlocks < 2.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description' 2025-10-14: TempTool [Show Current Template Info] <= 1.3.1 - Authenticated (Contributor+) Information Exposure 2026-01-23: RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure Proof of Concept (PoC) Code PoC Code: The page states that the PoC will be displayed on August 12, 2026, to give users time to update. Specific code is not provided.

Goal Reached Thanks to every supporter — we hit 100%!

MLS Import < 7.0.4 Authenticated Sensitive Information Disclosure via Missing CSRF Check (CVE-2026-17515)

More from this source