{"id":"CVE-2026-111956","title":"WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure","summary":"The WholesaleX  WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"WholesaleX","affected":["WholesaleX < 3.0.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-21T10:17:34.369318Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T10:35:02.923Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111956","references":[{"url":"https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.177Z","epss":0.00309,"epssPercentile":0.2355,"slug":"CVE-2026-111956","body":"## Overview\n\nThe WholesaleX  WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.\n\n## Affected\n\n- `WholesaleX < 3.0.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":226936,"id":"CVE-2026-111956","ts":1792579639912,"field":"cvss","old":null,"new":"5.9"},{"seq":226935,"id":"CVE-2026-111956","ts":1792579639912,"field":"severity","old":"none","new":"medium"}]}