HIGHCVSS v3.1 7.2Vulnerability
CVE-2026-125912
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.2
- Epss score
- 0.00153
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Score
- 7.2
- Cve id
- CVE-2026-125912
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-13T08:17:28+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-11-13T06:16:54.260
- Last modified
- 2026-11-13T19:19:23.297
- Epss percentile
- 0.04486
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph