What is the CVSS score of EUVD-2026-26906?

EUVD-2026-26906 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-26906?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26906. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for EUVD-2026-26906?

Yes, a patch is available for EUVD-2026-26906. Update the affected software to the latest version immediately.

Magic Export & Import EUVD-2026-26906

| CVE-2026-5335 MEDIUM

Files or Directories Accessible to External Parties (CWE-552)

2026-05-04 WPScan

WordPress Information Disclosure Path Traversal Magic Export Import Unknown

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:23 vuln.today

Public exploit code

Patch released

May 04, 2026 - 15:23 nvd

Patch available

Analysis Generated

May 04, 2026 - 14:23 vuln.today

CVSS changed

May 04, 2026 - 14:22 NVD

5.3 (None) 5.3 (MEDIUM)

Patch available

May 04, 2026 - 07:31 EUVD

EUVD ID Assigned

May 04, 2026 - 07:00 euvd

EUVD-2026-26906

Analysis Generated

May 04, 2026 - 07:00 vuln.today

CVE Published

May 04, 2026 - 06:00 nvd

MEDIUM 5.3

DescriptionCVE.org

The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.

AnalysisAI

Magic Export & Import WordPress plugin before version 1.2.0 stores exported CSV files in a publicly accessible web directory, allowing unauthenticated remote attackers to enumerate and download sensitive user data without authentication. The vulnerability affects all versions prior to 1.2.0, has publicly available proof-of-concept code, and carries moderate real-world risk due to the low attack complexity and high automatable nature of exploitation, though the actual severity is constrained by the fact that CSV export must first occur and require that files remain accessible.

Technical ContextAI

The vulnerability stems from improper output resource restriction (CWE-552), a category covering cases where application-generated files are stored without proper access controls. The Magic Export & Import plugin implements CSV export functionality for WordPress user data but fails to restrict web-accessible directory permissions or implement authentication checks on exported file locations. This allows directory traversal or direct enumeration of predictable file paths to retrieve sensitive exported data. The plugin likely stores exports in a subdirectory of wp-content or similar web-accessible location without .htaccess rules or PHP-level access checks. CPE indicates the affected product is the Magic Export & Import plugin for WordPress, version 0 through 1.2.0.

RemediationAI

Vendor-released patch: upgrade Magic Export & Import to version 1.2.0 or later. This patch should restrict CSV file access via proper directory permissions, .htaccess rules preventing web access to exported files, or relocation of exports to a non-web-accessible directory. As an interim workaround pending upgrade, administrators should manually delete all previously exported CSV files from the web-accessible directory, restrict read permissions on the export directory via .htaccess with 'deny from all' rules, or disable the export functionality entirely via plugin settings until patched. Administrators should also audit access logs to determine if exported files were accessed by unauthorized parties. See WPScan advisory ed6f00de-bbae-4e89-9d0e-ded0d70e781c for detailed patch notes.