---
id: "CVE-2026-126639"
page: "https://infrastack.ai/live/CVE-2026-126639"
kind: "vulnerability"
aliases: ["CVE-2026-126639"]
title: "WP Ultimate CSV Importer: exported post files readable by anyone online"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-ultimate-csv-importer"]
not_affected_if: ["plugin-not-installed", "single-post-export-never-used"]
published_at: "2026-11-14T07:17:20+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:28:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126639", "first_seen_at": "2026-11-14T07:27:45+00:00"}]
exploit_sources: []
---

# WP Ultimate CSV Importer: exported post files readable by anyone online

Link for people: https://infrastack.ai/live/CVE-2026-126639 (this .md is for agents)

The WP Ultimate CSV Importer WordPress plugins write single-post export files to a public location under a predictable name. An unauthenticated attacker can download the content and custom fields of any exported post, including non-public content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin versions in the WordPress admin under Plugins, or with `wp plugin list` if WP-CLI is available.
- Look for the plugin's export files in publicly reachable upload or export folders on the web server.

## Fix

- WP Ultimate CSV Importer: `9.2` or later
- WP Ultimate CSV Importer Pro: `9.0.7` or later

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126639

## From the sources

The WP Ultimate CSV Importer  WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name, allowing unauthenticated attackers to download the content and custom fields of any exported post, including non-public content.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_