CVE-2026-111956
Deferred Deferred - Pending Action

WholesaleX WordPress Plugin User Data Exposure Vulnerability

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-111956
EUVD
EUVD-2026-107078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WholesaleX 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WholesaleX WordPress plugin before version 3.0.9 stores a user-import file in a publicly accessible location with a predictable name. This allows unauthenticated users to download the file, which contains sensitive data such as account passwords, customer contact details, and address information.

Detection Guidance

Check for the presence of a publicly accessible CSV file named predictably in the WholesaleX plugin directory. Use commands like 'curl -I http://yoursite.com/wp-content/plugins/wholesalex/user-import.csv' to test access. Verify if the file contains sensitive data such as passwords or customer details.

Impact Analysis

Attackers can exploit this to steal sensitive user data, including passwords and personal information, leading to potential identity theft, fraud, or unauthorized account access. The exposure of passwords may also compromise other accounts if users reuse credentials.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to protect user information. It may also breach HIPAA if customer health-related data is exposed, leading to legal penalties and reputational damage.

Mitigation Strategies

Update the WholesaleX plugin to version 3.0.9 or later immediately. Remove the exposed CSV file from the public directory if it exists. Ensure no sensitive data remains exposed and review user accounts for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...