File Exposure Vulnerability in WP Ultimate CSV Importer by WordPress
CVE-2026-126639

Currently unrated

Key Information:

Vendor

WordPress
Status
WP Ultimate Csv Importer
WP Ultimate Csv Importer Pro
Vendor
CVE Published:
14 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-126639?

The WP Ultimate CSV Importer and its Pro version exhibit a security flaw that causes files exported via the single post export feature to be stored in a publicly accessible location. This exposure allows unauthenticated users to download the exported content and custom fields of any post, including sensitive and non-public information. Users are advised to upgrade to the latest versions to mitigate the risk associated with this vulnerability.

Affected Version(s)

WP Ultimate CSV Importer 0 < 9.2

WP Ultimate CSV Importer Pro 0 < 9.0.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-126639 - Proof of Concept

References

https://wpscan.com/vulnerability/d80fe4f1-ee4f-40db-a16b-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

vuxvinh
WPScan
.