{"id":"CVE-2026-111956","title":"WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure","summary":"The WholesaleX  WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user…","severity":"none","cwe":["CWE-200"],"product":"WholesaleX","affected":["WholesaleX < 3.0.9"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T06:00:23.300Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111956","references":[{"url":"https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.177Z","slug":"CVE-2026-111956","body":"## Overview\n\nThe WholesaleX  WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.\n\n## Affected\n\n- `WholesaleX < 3.0.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}