WholesaleX CVE-2026-111956

Exploitation requires that the site has actually used the WholesaleX user-import feature, so that an import file exists in the plugin's publicly accessible storage location under its predictable filename; the attacker then needs only an unauthenticated HTTP GET to that path. Limiting factors: the vulnerable version must be installed (before 3.0.9), an import must have been performed (and the file not yet overwritten or removed), and only the MOST RECENTLY imported dataset is retrievable - this precondition is why CVSS rates attack complexity High and SSVC marks the issue non-automatable. No authentication or user interaction is required once the file is present.

This is a genuine but conditional information-disclosure risk rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9 Medium) correctly captures the shape: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) because exploitation depends on a user-import file actually existing at the predictable location, and impact is confidentiality-only (C:H, I:N, A:N). These signals are internally consistent and align with the CISA SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) - notably SSVC says exploitation is NOT observed and the issue is NOT automatable, which matches the AC:H dependency on a precondition the attacker cannot create. A public exploit exists (WPScan/cveorg reference), so proof-of-concept is real, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of in-the-wild or widespread exploitation. The confidentiality impact is serious where it applies - the exposed file may contain account passwords and customer contact/address PII - so sites that have run the import feature should patch urgently, but the AC:H and non-automatable nature mean this is a targeted, opportunistic risk, not a wormable one. Note the C:H rating assumes the imported file contains cleartext or recoverable credentials and PII as the description states; the real severity for a given site depends on what was actually imported.

A WordPress site runs the WholesaleX plugin (before 3.0.9) and an administrator uses its user-import feature; the plugin leaves the uploaded import file in a web-accessible directory under a predictable name. An unauthenticated attacker who knows or guesses that path simply requests the URL and downloads the most recently imported data, obtaining customer account passwords and contact/address details. A public proof-of-concept for this path is available via WPScan.