Live › vulnerability › CVE-2026-111956
Go to dashboardThe WholesaleX WordPress plugin before 3.0.9 keeps its user-import file in a public location under a predictable name and never removes it. An unauthenticated visitor can download the most recent import, which can include account passwords and customer contact and address details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WholesaleX older than 3.0.9 that have used its user-import feature are exposed, because the import file stays online with predictable naming. Sites that never imported users through the plugin, or that run 3.0.9 or later, can skip it. The sources do not say which file path is used.
No product ranges from the sources yet.
wp plugin get wholesalex --field=version3.0.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
This page as .md · .json · in your agent: get_signal("CVE-2026-111956")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.