---
id: "CVE-2026-125912"
page: "https://infrastack.ai/live/CVE-2026-125912"
kind: "vulnerability"
aliases: ["CVE-2026-125912"]
title: "WP Ultimate CSV Importer WordPress plugin: subsite admins can write and run PHP"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "wordpress", "wordpress-multisite", "wp-ultimate-csv-importer"]
not_affected_if: ["plugin-9.2-or-later", "plugin-not-installed", "single-site-wordpress"]
published_at: "2026-11-13T06:16:54+00:00"
first_seen_at: "2026-11-13T06:42:17+00:00"
updated_at: "2026-11-13T06:42:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125912", "first_seen_at": "2026-11-13T06:42:17+00:00"}]
exploit_sources: []
---

# WP Ultimate CSV Importer WordPress plugin: subsite admins can write and run PHP

Link for people: https://infrastack.ai/live/CVE-2026-125912 (this .md is for agents)

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the filename, extension or content type of remote media it imports. An Administrator of a Multisite subsite can use this to write and execute arbitrary PHP in the shared WordPress context, even though they cannot install plugins or edit files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-ultimate-csv-importer --field=version` if WP-CLI is available.
- Check whether the site runs WordPress Multisite and whether subsite administrators exist.

## Fix

- WP Ultimate CSV Importer: move to `9.2` or later (the sources state the fix is in 9.2).

## Timeline

- 2026-11-13T06:42:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125912

## From the sources

The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer  WordPress plugin before 9.2 or edit files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_