User Data Exposure in WholesaleX WordPress Plugin
CVE-2026-111956

Currently unrated

Key Information:

Vendor

WordPress
Status
Wholesalex
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-111956?

The WholesaleX WordPress plugin, prior to version 3.0.9, exposes user-import files at a publicly accessible location with a predictable name. This vulnerability allows unauthenticated users to download recently imported user data, which can include sensitive information such as account passwords, customer contact details, and address information. This flaw signifies a significant risk for website owners using the outdated version of the plugin, highlighting the need for immediate updates and enhanced security measures.

Affected Version(s)

WholesaleX 0 < 3.0.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-111956 - Proof of Concept

References

https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala
WPScan
.