CVE-2026-125912 · Other
NO FIX YET · SEE WHAT TO DO
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the filename, extension or content type of remote media it imports. An Administrator of a Multisite subsite can use this to write and execute arbitrary PHP in the shared WordPress context, even though they cannot install plugins or edit files.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the WP Ultimate CSV Importer plugin before 9.2 on a WordPress Multisite network are exposed, since the flaw lets a subsite Administrator write and run PHP in the shared context. Single-site installs and networks without this plugin are not affected by this description. Network operators should look at which subsite admins they trust.
Not affected if plugin-9.2-or-later, plugin-not-installed, single-site-wordpress
Who cares wordpress, wordpress-multisite, wp-ultimate-csv-importer
wp plugin get wp-ultimate-csv-importer --field=version if WP-CLI is available.9.2 or later (the sources state the fix is in 9.2).The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.