CVE-2026-80518

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: WPScan

Description

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-80518

EUVD

EUVD-2026-91936

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WP	Ultimate CSV Importer 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The WP Ultimate CSV Importer plugin before version 9.2 stores import logs in the uploads directory without using a site-specific secret to determine their location or blocking direct access. This allows unauthenticated attackers to retrieve personal data from CSV imports without needing authentication.

Detection Guidance

Check for exposed import logs in the uploads directory by accessing paths like /wp-content/uploads/csv_importer_logs/ or similar. Use commands like curl or wget to test direct access to these files. Verify if logs contain sensitive user data without authentication.

Impact Analysis

Unauthenticated attackers can access sensitive personal data imported via CSV files, potentially exposing user information such as names, email addresses, or other details stored in the logs.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA, as it allows unauthorized access to personal data, violating principles of data confidentiality and security.

Mitigation Strategies

Update the WP Ultimate CSV Importer plugin to version 9.2 or later immediately. Ensure the plugin's logs directory is not publicly accessible by checking server permissions and adding .htaccess rules to block direct access.

Hi! I’m here to help you understand CVE-2026-80518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70