CVE-2026-126639
WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name, allowing unauthenticated attackers to download the content and custom fields of any exported post, including non-public content.
| Vendor | unknown |
| Product | wp ultimate csv importer |
| Published | Nov 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp ultimate csv importer
Be the first to know when new unknown vulnerabilities affecting unknown wp ultimate csv importer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Ultimate CSV Importer
0 < 9.2
Unknown / WP Ultimate CSV Importer Pro
0 < 9.0.7
References
Credits
vuxvinh WPScan