CVE-2026-80518 WP Ultimate CSV Importer CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP Ultimate CSV Importer plugin should assess exposure and prioritize updating the plugin to version 9.2 or later. This includes administrators, security teams, and IT personnel who manage WordPress installations and are responsible for ensuring the security and integrity of user data. Additionally, users who have imported personal data using the WP Ultimate CSV Importer plugin should be aware of

Why it matters

The WP Ultimate CSV Importer plugin vulnerability allows unauthenticated attackers to retrieve personal data, requiring defenders to verify exposure and prioritize remediation.

• Unauthenticated attackers can retrieve personal data of users imported from a CSV file
• Defenders need to verify the presence of this vulnerability in their WordPress installations
• Updating the plugin to version 9.2 or later is necessary to mitigate the vulnerability

Technical summary

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them. This allows unauthenticated attackers to retrieve the personal data of users imported from a CSV file. The vulnerability is caused by the lack of proper security measures in the plugin, making it essential for defenders to assess their exposure and prioritize remediation. The vulnerability can be mitigated by updating the plugin to version 9.2 or later.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and updating the plugin to version 9.2 or later if necessary.

Recommended defensive actions

• Verify the presence of this vulnerability in WordPress installations
• Update the plugin to version 9.2 or later if necessary
• Restrict access to import logs under the uploads directory
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The WPScan reference provides additional context about the vulnerability. However, the details are still limited, and defenders need to verify the presence of this vulnerability in their WordPress installations. The lack of site-specific secrets in deriving storage locations for import logs under the uploads directory increases the risk of unauthorized access to personal data. To verify exposure, defenders should check for the presence of the vulnerable

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.