{"id":"CVE-2026-125912","kind":"vulnerability","aliases":["CVE-2026-125912"],"related":[],"title":"WP Ultimate CSV Importer WordPress plugin: subsite admins can write and run PHP","description":"The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer  WordPress plugin before 9.2 or edit files.","summary":"The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the filename, extension or content type of remote media it imports. An Administrator of a Multisite subsite can use this to write and execute arbitrary PHP in the shared WordPress context, even though they cannot install plugins or edit files.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","wordpress","wordpress-multisite","wp-ultimate-csv-importer"],"not_affected_if":["plugin-9.2-or-later","plugin-not-installed","single-site-wordpress"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-ultimate-csv-importer --field=version` if WP-CLI is available.\n- Check whether the site runs WordPress Multisite and whether subsite administrators exist.","fix":"- WP Ultimate CSV Importer: move to `9.2` or later (the sources state the fix is in 9.2).","status":"open","published_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","triaged_at":"2026-11-13T06:42:23+00:00","updated_at":"2026-11-13T06:42:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T06:42:23Z","model":"claude-haiku-5-5","output":{"fix":"- WP Ultimate CSV Importer: move to `9.2` or later (the sources state the fix is in 9.2).","reach":"network","title":"WP Ultimate CSV Importer WordPress plugin: subsite admins can write and run PHP","impact":"high","summary":"The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the filename, extension or content type of remote media it imports. An Administrator of a Multisite subsite can use this to write and execute arbitrary PHP in the shared WordPress context, even though they cannot install plugins or edit files.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wordpress-multisite","wp-ultimate-csv-importer"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Subsite administrator runs arbitrary PHP across the shared WordPress network","analyst_note":"Confirm the affected version range beyond 'before 9.2' and whether the plugin is in the WordPress.org repository, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125912.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-ultimate-csv-importer --field=version` if WP-CLI is available.\n- Check whether the site runs WordPress Multisite and whether subsite administrators exist.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-site-wordpress","plugin-not-installed","plugin-9.2-or-later"],"who_is_affected":"Sites running the WP Ultimate CSV Importer plugin before 9.2 on a WordPress Multisite network are exposed, since the flaw lets a subsite Administrator write and run PHP in the shared context. Single-site installs and networks without this plugin are not affected by this description. Network operators should look at which subsite admins they trust.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000825,"input_tokens":4598,"output_tokens":731,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-125912':16A,19A '-2026':15A,18A '9.2':38B,90C,145C 'admin':8A 'administr':54B,111C,132C 'allow':109C 'arbitrari':66B,120C 'cannot':76B 'content':46B,103C 'context':72B,126C 'csv':3A,28B,33B,85C,140C 'cve':14A,17A 'despit':127C 'destin':95C 'edit':80B,147C 'even':73B 'execut':65B,119C 'extens':44B,98C 'fetch':102C 'file':81B,148C 'filenam':43B,96C 'import':4A,29B,34B,52B,86C,106C,141C 'instal':77B,137C 'media':50B,108C 'multisit':24B,57B,114C 'network':131C 'php':13A,67B,121C 'plugin':6A,36B,78B,88C,143C 'remot':49B,107C 'restrict':41B,93C 'run':12A 'share':70B,124C 'subsit':7A,58B,115C 'though':74B 'type':47B,104C 'ultim':2A,27B,32B,84C,139C 'unabl':135C 'use':60B 'valid':100C 'wordpress':5A,21B,23B,35B,71B,87C,125C,142C 'wordpress-multisit':22B 'wp':1A,26B,31B,83C,138C 'wp-ultimate-csv-import':25B 'write':10A,63B,117C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Ultimate CSV Importer plugin before 9.2 on a WordPress Multisite network are exposed, since the flaw lets a subsite Administrator write and run PHP in the shared context. Single-site installs and networks without this plugin are not affected by this description. Network operators should look at which subsite admins they trust.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","other","wordpress","wordpressmultisite","wpultimatecsvimporter"],"campaign_type":null,"search_a":"'-125912':16A,19A '-2026':15A,18A 'admin':8A 'csv':3A 'cve':14A,17A 'import':4A 'php':13A 'plugin':6A 'run':12A 'subsit':7A 'ultim':2A 'wordpress':5A 'wp':1A 'write':10A","search_b":"'9.2':38B 'administr':54B 'arbitrari':66B 'cannot':76B 'content':46B 'context':72B 'csv':28B,33B 'edit':80B 'even':73B 'execut':65B 'extens':44B 'file':81B 'filenam':43B 'import':29B,34B,52B 'instal':77B 'media':50B 'multisit':24B,57B 'php':67B 'plugin':36B,78B 'remot':49B 'restrict':41B 'share':70B 'subsit':58B 'though':74B 'type':47B 'ultim':27B,32B 'use':60B 'wordpress':21B,23B,35B,71B 'wordpress-multisit':22B 'wp':26B,31B 'wp-ultimate-csv-import':25B 'write':63B","search_c":"'9.2':90C,145C 'administr':111C,132C 'allow':109C 'arbitrari':120C 'content':103C 'context':126C 'csv':85C,140C 'despit':127C 'destin':95C 'edit':147C 'execut':119C 'extens':98C 'fetch':102C 'file':148C 'filenam':96C 'import':86C,106C,141C 'instal':137C 'media':108C 'multisit':114C 'network':131C 'php':121C 'plugin':88C,143C 'remot':107C 'restrict':93C 'share':124C 'subsit':115C 'type':104C 'ultim':84C,139C 'unabl':135C 'valid':100C 'wordpress':87C,125C,142C 'wp':83C,138C 'write':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125912","severity":null,"published_at":"2026-11-13T06:16:54+00:00","modified_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","fetched_at":"2026-11-13T06:42:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}