medium5.9
CVE-2026-111956
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable nam…
Impact
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
Affected products
| Product | Affected versions |
|---|---|
| WholesaleX WordPress Plugin | before 3.0.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.