CVE-2026-111956: WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WholesaleXto a version that resolves this vulnerability.Fixed in 3.0.9
Event History
Frequently Asked Questions
Which installations are exposed?
WholesaleX WordPress plugin versions before 3.0.9 are affected. Exposure depends on whether user data has been imported, because the disclosed file is the most recently imported user CSV.
Does an attacker need an account or other access to retrieve the data?
No. The CSV can be downloaded by unauthenticated users because it is retained in a publicly accessible location with a predictable name.
What data could be exposed?
The most recently imported user CSV may contain account passwords, customer contact details, and address information, depending on the contents of the imported file.
What can be done if an upgrade cannot be applied immediately?
Remove the retained user-import file from its publicly accessible location and avoid importing user CSV files that contain passwords or sensitive customer information until the issue is remediated.