Dashboard / CVE-2026-125912

CVE-2026-125912

HIGH
MEDIUM Priority: 0.01 BB Relevance: 59/100
Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: High
A: High

Description

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown WP Ultimate CSV Importer 0 < 9.2
Unknown WP Ultimate CSV Importer 0 < 9.2

References & Advisories (1)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.15%
Raw Score 0.001530
Percentile 4.5%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links