{"id":"CVE-2026-111956","kind":"vulnerability","aliases":["CVE-2026-111956"],"related":[],"title":"WholesaleX WordPress plugin exposes imported user data file publicly","description":"The WholesaleX  WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.","summary":"The WholesaleX WordPress plugin before 3.0.9 keeps its user-import file in a public location under a predictable name and never removes it. An unauthenticated visitor can download the most recent import, which can include account passwords and customer contact and address details.","severity":"medium","cvss":5.9,"epss":0.00226,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wholesalex","woocommerce","wordpress"],"not_affected_if":["never-used-user-import","version-3.0.9-or-later"],"how_to_check":"- Check the installed WholesaleX version in the WordPress plugins screen or `wp plugin get wholesalex --field=version`\n- Look for a publicly reachable user-import file in the uploads area of the site, and request it from a browser without logging in (exact path: unknown)","fix":"- Update the WholesaleX plugin to `3.0.9` or later\n- Delete any old user-import files left in public upload folders and rotate passwords for accounts that were imported from them","status":"open","published_at":"2026-10-21T06:16:48+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:08:05+00:00","updated_at":"2026-10-25T04:08:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:08:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WholesaleX plugin to `3.0.9` or later\n- Delete any old user-import files left in public upload folders and rotate passwords for accounts that were imported from them","reach":"internet","title":"WholesaleX WordPress plugin exposes imported user data file publicly","impact":"medium","summary":"The WholesaleX WordPress plugin before 3.0.9 keeps its user-import file in a public location under a predictable name and never removes it. An unauthenticated visitor can download the most recent import, which can include account passwords and customer contact and address details.","category":"package","nicknames":[],"who_cares":["wordpress","wholesalex","woocommerce","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated visitors download imported customer data including account passwords","analyst_note":"Find the vulnerable file path and the exact import feature that writes it from the NVD entry or the plugin changelog for 3.0.9.","how_to_check":"- Check the installed WholesaleX version in the WordPress plugins screen or `wp plugin get wholesalex --field=version`\n- Look for a publicly reachable user-import file in the uploads area of the site, and request it from a browser without logging in (exact path: unknown)","needs_analyst":true,"not_affected_if":["version-3.0.9-or-later","never-used-user-import"],"who_is_affected":"Sites running WholesaleX older than 3.0.9 that have used its user-import feature are exposed, because the import file stays online with predictable naming. Sites that never imported users through the plugin, or that run 3.0.9 or later, can skip it. The sources do not say which file path is used.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3358,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111956':12A,15A '-2026':11A,14A '3.0.9':28B,72C 'access':88C 'account':59B,107C 'address':65B,113C 'allow':94C 'contact':63B,111C 'contain':116C 'custom':62B,110C 'cve':10A,13A 'data':7A,104C 'detail':66B,114C 'download':51B,98C 'expos':4A 'file':8A,34B,82C 'host':19B 'import':5A,33B,55B,81C,102C 'includ':58B,105C 'keep':29B,84C 'locat':38B,89C 'name':42B,93C 'never':44B 'packag':16B 'password':60B,108C 'plugin':3A,26B,70C 'predict':41B,92C 'protect':75C 'public':9A,37B,87C 'recent':54B,101C 'remov':45B,77C 'self':18B 'self-host':17B 'unauthent':48B,95C 'user':6A,32B,80C,96C,103C 'user-import':31B,79C 'visitor':49B 'wholesalex':1A,20B,24B,68C 'woocommerc':21B 'wordpress':2A,22B,25B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running WholesaleX older than 3.0.9 that have used its user-import feature are exposed, because the import file stays online with predictable naming. Sites that never imported users through the plugin, or that run 3.0.9 or later, can skip it. The sources do not say which file path is used.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111956","severity":null,"published_at":"2026-10-21T06:16:48+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111956","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111956","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}