CVE-2026-80518
WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path
- State
- Published
- Severity
- 3.7 Low
- Published
- Oct 3, 2026
- Updated
- Oct 3, 2026
- Reserved
- Aug 26, 2026
Description
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
WP Ultimate CSV ImporterUnknown |
|
References
- https://wpscan.com/vulnerability/80563420-5471-42a9-b022-b3d9792c07aa/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.