IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
Puansız

CVE-2026-126639WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path

WP Ultimate CSV Importer; WP Ultimate CSV Importer Pro Yayım: (1 saat önce)

Açıklama

The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name, allowing unauthenticated attackers to download the content and custom fields of any exported post, including non-public content.

Zayıflık türü (CWE): CWE-200

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
— WP Ultimate CSV Importer < 9.2
— WP Ultimate CSV Importer Pro < 9.0.7

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress plugins & themes

Puansız
CVE-2026-119258

Swipe <= 1.4 - Unauthenticated Authentication Bypass

Swipe

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.

Puansız
CVE-2026-123046

SEOJuice < 2.12.0 - Administrator Account Creation via CSRF

SEOJuice

The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, in…