CVE-2026-111956 — WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure

CVE-2026-111956

WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure PUBLISHED

Description (CNA)

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.

Affected (CNA)

Vendor / product	Versions
Unknown / WholesaleX	affected 0 before 3.0.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.