CVE-2026-80518: WP Ultimate CSV Importer 0 to before 9.2

Affected technology

WP Ultimate CSV Importer · 0 to before 9.2
Vendor not specified by the source

Description’s affected range: before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says the WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file. Source advisory’s CVSS 3.1 assessment (base score 3.7/10) rates confidentiality impact as low; integrity and availability impact as none.