The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs… (CVE-2026-80518)
The WP Ultimate CSV Importer WordPress plugin versions before 9.2 do not use a site-specific secret when determining where import logs are stored under the uploads directory. Additionally, the plugin does not block direct access to these logs. This allows unauthenticated attackers to retrieve personal data of users imported from CSV files.
AI Analysis
Technical Summary
The vulnerability in WP Ultimate CSV Importer versions prior to 9.2 involves the lack of a site-specific secret in deriving the storage location of import logs within the uploads directory. Furthermore, the plugin fails to restrict direct access to these logs. As a result, unauthenticated attackers can access import logs containing personal user data imported from CSV files, potentially leading to data exposure.
Potential Impact
Unauthenticated attackers can access import logs stored under the uploads directory, which contain personal data of users imported via CSV files. This exposure can lead to unauthorized disclosure of sensitive user information.
Mitigation Recommendations
A fix is available in version 9.2 of the WP Ultimate CSV Importer plugin. Users should upgrade to version 9.2 or later to ensure that import logs are stored securely with a site-specific secret and that direct access to these logs is blocked.
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs… (CVE-2026-80518)
Description
The WP Ultimate CSV Importer WordPress plugin versions before 9.2 do not use a site-specific secret when determining where import logs are stored under the uploads directory. Additionally, the plugin does not block direct access to these logs. This allows unauthenticated attackers to retrieve personal data of users imported from CSV files.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in WP Ultimate CSV Importer versions prior to 9.2 involves the lack of a site-specific secret in deriving the storage location of import logs within the uploads directory. Furthermore, the plugin fails to restrict direct access to these logs. As a result, unauthenticated attackers can access import logs containing personal user data imported from CSV files, potentially leading to data exposure.
Potential Impact
Unauthenticated attackers can access import logs stored under the uploads directory, which contain personal data of users imported via CSV files. This exposure can lead to unauthorized disclosure of sensitive user information.
Mitigation Recommendations
A fix is available in version 9.2 of the WP Ultimate CSV Importer plugin. Users should upgrade to version 9.2 or later to ensure that import logs are stored securely with a site-specific secret and that direct access to these logs is blocked.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w4w7-6vj3-3c3v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-80518"]
- State
- PUBLISHED
Threat ID: 6ac13990a43b0b3b89d69994
Added to database: 10/03/2026, 17:21:20 UTC
Last enriched: 10/03/2026, 17:34:01 UTC
Last updated: 10/04/2026, 01:45:56 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.