CVE-2026-126639: WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path
The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name, allowing unauthenticated attackers to download the content and custom fields of any exported post, including non-public content.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated disclosure?
Sites using WP Ultimate CSV Importer before 9.2 or WP Ultimate CSV Importer Pro before 9.0.7 are exposed when the single post export feature has created export files. The exported content and custom fields can include non-public posts.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They need to request the publicly accessible export file using its predictable path and name.
Are sites affected if they have not used single post export?
The described exposure concerns files created by the single post export feature. The provided information does not establish exposure without such exported files being present.
How can administrators check for possible exposure?
Review whether the affected plugin version is installed and whether the single post export feature has generated files in its publicly accessible export location. Treat exported non-public posts and custom fields as potentially disclosed if those files were accessible under predictable names.