CVE-2026-125912
WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
What each source reports
CVE ListNo score
WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
- Record
CVE-2026-125912- Updated
- 2026-11-13
EUVDEUVD-2026-124853No score
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
- Record
EUVD-2026-124853- Updated
- 2026-11-13
GitHub AdvisoriesGHSA-hc8x-8wg2-9c9pNo score
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination...
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
- Record
GHSA-hc8x-8wg2-9c9p- Updated
- 2026-11-13
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| aliases | EUVD | |
| products, published, references, title | CVE List | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-125912 is a vulnerability with no CVSS score yet in Unknown Wp Ultimate Csv Importer, published November 13, 2026. No source lists public exploit code. No source names a fixed version.