Vulnerability record/PUBLISHED/Published Nov 13, 2026 06:00:09 UTC
CVE-2026-125912
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 13, 2026 06:00:09 UTC
PublishedNov 13, 2026 06:00:09 UTC
ReservedNov 10, 2026 13:26:13 UTC
Credits
- Charles Vosburgh
- WPScan