CVE-2026-80518
Received Received - Intake

Information Disclosure in WP Ultimate CSV Importer WordPress Plugin

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: WPScan

Description
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-80518
EUVD
EUVD-2026-91936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_ultimate_csv_importer wp_ultimate_csv_importer to 9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Ultimate CSV Importer plugin before version 9.2 stores import logs in the uploads directory without using a site-specific secret to determine their location or blocking direct access. This allows unauthenticated attackers to retrieve personal data from CSV imports without needing authentication.

Detection Guidance

Check for exposed import logs in the uploads directory by accessing paths like /wp-content/uploads/csv_importer_logs/ or similar. Use commands like curl or wget to test direct access to these files. Verify if logs contain sensitive user data without authentication.

Impact Analysis

Unauthenticated attackers can access sensitive personal data imported via CSV files, potentially exposing user information such as names, email addresses, or other details stored in the logs.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA, as it allows unauthorized access to personal data, violating principles of data confidentiality and security.

Mitigation Strategies

Update the WP Ultimate CSV Importer plugin to version 9.2 or later immediately. Ensure the plugin's logs directory is not publicly accessible by checking server permissions and adding .htaccess rules to block direct access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80518. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart