CVE-2026-111956: WholesaleX WordPress Information Disclosure

CVE-2026-111956 Overview

CVE-2026-111956 is an information disclosure vulnerability in the WholesaleX WordPress plugin versions before 3.0.9. The plugin stores user-import files in a publicly accessible location using a predictable file name. The plugin fails to protect or remove these files after import completes. Unauthenticated attackers can download the most recently imported user data by requesting the predictable URL. Exposed data includes account passwords, customer contact information, and address details. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated attackers can retrieve imported user credentials and personally identifiable information (PII) directly from the WordPress site, enabling account takeover and downstream fraud.

Affected Products

WholesaleX WordPress plugin versions prior to 3.0.9
WordPress sites using WholesaleX for bulk user or customer imports
E-commerce deployments relying on WholesaleX wholesale account management

Discovery Timeline

2026-10-21 - CVE CVE-2026-111956 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111956

Vulnerability Analysis

The WholesaleX plugin provides bulk user import functionality for WordPress and WooCommerce stores. During import, the plugin writes the uploaded source file to a web-accessible directory under the WordPress uploads path. The file retains a predictable name that an attacker can guess or enumerate without authentication.

The plugin does not apply access control, random suffixes, or .htaccess restrictions to this file. It also fails to delete the file after the import process completes. Any remote user who knows the WordPress site URL can issue an HTTP GET request to the predictable path and download the file.

Import files for user management typically contain usernames, email addresses, hashed or plaintext passwords, billing addresses, and phone numbers. Disclosure of this data enables credential stuffing, targeted phishing, and account takeover against the affected customers.

Root Cause

The root cause is insecure file handling in the import workflow. The plugin places sensitive import artifacts in a predictable public location without authorization checks or cleanup logic. This matches the CWE-200 pattern of exposing sensitive information to an unauthorized actor.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker enumerates or guesses the predictable file path under the WordPress uploads directory and issues a direct HTTP request. Successful exploitation requires that an administrator has recently used the import feature, which accounts for the higher attack complexity reflected in the CVSS vector. See the WPScan Vulnerability Advisory for additional detail.

Detection Methods for CVE-2026-111956

Indicators of Compromise

Unauthenticated HTTP GET requests to files under /wp-content/uploads/ matching WholesaleX import file naming patterns.
Access log entries from unknown IP addresses targeting predictable import file paths shortly after an admin-triggered import.
Presence of leftover import files in the uploads directory containing user credential or PII data.

Detection Strategies

Review WordPress and web server access logs for GET requests to WholesaleX import artifacts returning HTTP 200 responses.
Scan the uploads directory for stale user-import files that should have been removed after import completion.
Correlate suspicious downloads with subsequent failed or anomalous login activity against imported accounts.

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/uploads/ directory to flag creation of import files.
Alert on repeated requests to predictable file paths from external IP addresses.
Monitor authentication logs for credential stuffing patterns targeting recently imported user accounts.

How to Mitigate CVE-2026-111956

Immediate Actions Required

Upgrade the WholesaleX plugin to version 3.0.9 or later on all WordPress installations.
Delete any residual import files from the WordPress uploads directory immediately.
Force a password reset for all user accounts that were imported using the vulnerable version.
Notify affected customers of the potential exposure of contact and address data.

Patch Information

The vendor has resolved the issue in WholesaleX version 3.0.9. The patch removes or protects the import file after processing and prevents public access to the artifact. Refer to the WPScan Vulnerability Advisory for vendor and advisory references.

Workarounds

Block direct access to WholesaleX import file paths at the web server or WAF layer until the plugin is upgraded.
Add .htaccess or Nginx location rules denying public access to known import file names.
Avoid using the WholesaleX user import feature until the patched version is deployed.

bash

# Example Nginx rule to block access to WholesaleX import artifacts
location ~* /wp-content/uploads/.*wholesalex.*\.(csv|xlsx|json)$ {
    deny all;
    return 403;
}