Unrated severityNVD Advisory· Published Oct 21, 2026

CVE-2026-111956

Description

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/WholesaleXllm-fuzzy
Range: <3.0.9

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000