CVE-2026-125912: high-severity vulnerability in WP Ultimate CSV Importer
WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · WP Ultimate CSV ImporterRelated CVEs — WP Ultimate CSV Importer
In the same product, most dangerous first.
CVE-2026-80488MEDIUMWP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import FieldsEPSS 0.3%CVE-2026-80518LOWWP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log PathEPSS 0.2%CVE-2026-80517LOWWP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG UploadEPSS 0.1%