CVE-2026-125912
WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
| Vendor | unknown |
| Product | wp ultimate csv importer |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp ultimate csv importer
Be the first to know when new unknown vulnerabilities affecting unknown wp ultimate csv importer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Ultimate CSV Importer
0 < 9.2
References
Credits
Charles Vosburgh WPScan