CVE-2026-111956

UNKNOWN 0.0

WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.

Vendor	unknown
Product	wholesalex
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for unknown wholesalex

Be the first to know when new unknown vulnerabilities affecting unknown wholesalex are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / WholesaleX

0 < 3.0.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd/

Credits

Muni Nitish Kumar Yaddala WPScan