{"id":"CVE-2026-126639","kind":"vulnerability","aliases":["CVE-2026-126639"],"related":[],"title":"WP Ultimate CSV Importer: exported post files readable by anyone online","description":"The WP Ultimate CSV Importer  WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name, allowing unauthenticated attackers to download the content and custom fields of any exported post, including non-public content.","summary":"The WP Ultimate CSV Importer WordPress plugins write single-post export files to a public location under a predictable name. An unauthenticated attacker can download the content and custom fields of any exported post, including non-public content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-ultimate-csv-importer"],"not_affected_if":["plugin-not-installed","single-post-export-never-used"],"how_to_check":"- Check the installed plugin versions in the WordPress admin under Plugins, or with `wp plugin list` if WP-CLI is available.\n- Look for the plugin's export files in publicly reachable upload or export folders on the web server.","fix":"- WP Ultimate CSV Importer: `9.2` or later\n- WP Ultimate CSV Importer Pro: `9.0.7` or later","status":"open","published_at":"2026-11-14T07:17:20+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:08+00:00","updated_at":"2026-11-14T07:28:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T07:28:08Z","model":"claude-haiku-5-5","output":{"fix":"- WP Ultimate CSV Importer: `9.2` or later\n- WP Ultimate CSV Importer Pro: `9.0.7` or later","reach":"internet","title":"WP Ultimate CSV Importer: exported post files readable by anyone online","impact":"medium","summary":"The WP Ultimate CSV Importer WordPress plugins write single-post export files to a public location under a predictable name. An unauthenticated attacker can download the content and custom fields of any exported post, including non-public content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-ultimate-csv-importer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Anyone can download exported post content and custom fields","analyst_note":"","how_to_check":"- Check the installed plugin versions in the WordPress admin under Plugins, or with `wp plugin list` if WP-CLI is available.\n- Look for the plugin's export files in publicly reachable upload or export folders on the web server.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","single-post-export-never-used"],"who_is_affected":"Sites running the free WP Ultimate CSV Importer below 9.2 or the Pro version below 9.0.7 that have used the single post export feature. The exposure is through the public file location the export writes to, so sites that never used single post export are less likely to hold exposed files. Sites that do not run these plugins can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4592,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126639':14A,17A '-2026':13A,16A '9.0.7':85C '9.2':76C 'access':103C 'allow':109C 'anyon':10A 'attack':51B,111C 'content':55B,67B,115C,127C 'creat':91C 'csv':3A,26B,31B,71C,79C 'custom':57B,117C 'cve':12A,15A 'download':53B,113C 'export':5A,39B,61B,96C,121C 'featur':97C 'field':58B,118C 'file':7A,40B,90C 'host':21B 'import':4A,27B,32B,72C,80C 'includ':63B,123C 'locat':44B,104C 'name':48B,108C 'non':65B,125C 'non-publ':64B,124C 'onlin':11A 'packag':18B 'plugin':34B,74C,83C 'post':6A,38B,62B,95C,122C 'predict':47B,107C 'pro':81C 'protect':88C 'public':43B,66B,102C,126C 'readabl':8A 'self':20B 'self-host':19B 'singl':37B,94C 'single-post':36B 'ultim':2A,25B,30B,70C,78C 'unauthent':50B,110C 'wordpress':22B,33B,73C,82C 'wp':1A,24B,29B,69C,77C 'wp-ultimate-csv-import':23B 'write':35B,98C","nicknames":[],"mitigations":[],"who_affected":"Sites running the free WP Ultimate CSV Importer below 9.2 or the Pro version below 9.0.7 that have used the single post export feature. The exposure is through the public file location the export writes to, so sites that never used single post export are less likely to hold exposed files. Sites that do not run these plugins can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpultimatecsvimporter"],"campaign_type":null,"search_a":"'-126639':14A,17A '-2026':13A,16A 'anyon':10A 'csv':3A 'cve':12A,15A 'export':5A 'file':7A 'import':4A 'onlin':11A 'post':6A 'readabl':8A 'ultim':2A 'wp':1A","search_b":"'attack':51B 'content':55B,67B 'csv':26B,31B 'custom':57B 'download':53B 'export':39B,61B 'field':58B 'file':40B 'host':21B 'import':27B,32B 'includ':63B 'locat':44B 'name':48B 'non':65B 'non-publ':64B 'packag':18B 'plugin':34B 'post':38B,62B 'predict':47B 'public':43B,66B 'self':20B 'self-host':19B 'singl':37B 'single-post':36B 'ultim':25B,30B 'unauthent':50B 'wordpress':22B,33B 'wp':24B,29B 'wp-ultimate-csv-import':23B 'write':35B","search_c":"'9.0.7':85C '9.2':76C 'access':103C 'allow':109C 'attack':111C 'content':115C,127C 'creat':91C 'csv':71C,79C 'custom':117C 'download':113C 'export':96C,121C 'featur':97C 'field':118C 'file':90C 'import':72C,80C 'includ':123C 'locat':104C 'name':108C 'non':125C 'non-publ':124C 'plugin':74C,83C 'post':95C,122C 'predict':107C 'pro':81C 'protect':88C 'public':102C,126C 'singl':94C 'ultim':70C,78C 'unauthent':110C 'wordpress':73C,82C 'wp':69C,77C 'write':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126639","severity":null,"published_at":"2026-11-14T07:17:20+00:00","modified_at":"2026-11-14T07:17:20+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}