CVE-2026-80518

WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.

Affected

WP Ultimate CSV Importer

CVSS v3.1 CNA

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 7th percentile

Published

2026-10-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/80563420-5471-42a9-b022-b3d9792c07aa/

References

• CVE Record
• NVD entry