CVE-2026-125912: falha de alta gravidade em WP Ultimate CSV Importer
WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · WP Ultimate CSV ImporterCVEs relacionadas — WP Ultimate CSV Importer
No mesmo produto, das mais perigosas para as menos.
CVE-2026-80488MEDIUMWP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import FieldsEPSS 0.3%CVE-2026-80518LOWWP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log PathEPSS 0.2%CVE-2026-80517LOWWP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG UploadEPSS 0.1%