WP Ultimate CSV Importer EUVD-2026-91936

Exploitation requires that the site has actually used WP Ultimate CSV Importer (before 9.2) to import user/personal data, so that import-log files containing that data exist under the WordPress uploads directory. The flaw is that the log storage path is not derived from a site-specific secret and direct web access to the files is not blocked, so an attacker must still discover or predict the (non-random) path - the AC:H factor. Limiting factors: no useful data is exposed if no sensitive import was ever run or if logs have been cleared; the attacker needs to know or guess the file location; and only data present in those CSV import logs is disclosed (no write/admin access is gained). No authentication or user interaction is required (PR:N/UI:N).

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) shows the only barrier is attack complexity: AC:H reflects that without a site-specific secret an attacker must still discover or predict the storage path of the import-log files under the uploads directory before they can be fetched directly. Impact is confined to confidentiality (C:L) - leakage of personal data from CSV-imported users - with no integrity or availability effect. The supporting signals reinforce low urgency: EPSS is 0.14% (3rd percentile), indicating very low modeled probability of exploitation, and the vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation. Public exploit code exists (WPScan), which raises accessibility, but POC availability is a distinct signal from in-the-wild use and should not be conflated. No SSVC decision data was provided in the input. The signals are internally consistent (low CVSS, low EPSS, no KEV) - the only mild tension is POC-available versus low EPSS, which is common for low-impact information-disclosure bugs that are easy to reproduce but unattractive to mass-exploit. Net: a real but low-severity data-exposure flaw worth patching in routine cycles, not an emergency.

An unauthenticated attacker who knows a target site runs WP Ultimate CSV Importer below 9.2 and has performed a user/data import attempts to locate the plaintext import-log files written under the WordPress uploads directory. Because the storage location is not derived from a site-specific secret and direct access is not blocked, the attacker brute-forces or predicts the path and downloads the logs, harvesting personal data of imported users. Public exploit code for this technique is available from WPScan.