CVE-2026-111956: WholesaleX 0 to before 3.0.9

Affected technology

WholesaleX · 0 to before 3.0.9
Vendor not specified by the source

Description’s affected range: before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name

Component: Not specified by the source

What an attacker can do

The source says the WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.