CVE-2026-5335: Magic Export & Import Information Disclosure

CVE-2026-5335 Overview

CVE-2026-5335 affects the Magic Export & Import WordPress plugin in versions before 1.2.0. The plugin writes exported CSV files to a publicly accessible location on the web server. Any unauthenticated visitor who knows or guesses the file path can download these exports. Because the plugin is used to export site data, the CSV files often contain sensitive user information such as names, email addresses, and account metadata. The flaw is classified under CWE-552: Files or Directories Accessible to External Parties. Exploitation requires no authentication, no user interaction, and only network access to the affected WordPress site.

Critical Impact
Unauthenticated remote attackers can retrieve exported CSV files containing user data directly from the public file system, leading to disclosure of personally identifiable information (PII).

Affected Products

Magic Export & Import WordPress plugin versions prior to 1.2.0
WordPress sites with the plugin installed and exports generated
Any deployment where the plugin's export directory is reachable over HTTP/HTTPS

Discovery Timeline

2026-05-04 - CVE-2026-5335 published to the National Vulnerability Database (NVD)
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-5335

Vulnerability Analysis

The Magic Export & Import plugin generates CSV exports of WordPress data and stores them inside a directory served by the web server. The plugin does not place the export directory outside the web root, does not enforce authentication on file requests, and does not generate unguessable file names. As a result, an attacker who reaches the storage path can download the exports directly. The vulnerability is an information disclosure issue rather than a code execution flaw, but it exposes data the plugin is specifically designed to handle: user records, order data, or other content selected for export. WordPress sites that have run an export at any point retain the artifact until an administrator deletes it, which extends the window of exposure indefinitely.

Root Cause

The root cause is insecure storage of generated artifacts, mapped to [CWE-552]. The plugin treats the export directory as internal storage but exposes it through the web server with no access control. There is no .htaccess deny rule, no randomized token in the filename, and no nonce-protected handler that streams the file to an authorized user. Predictable paths and missing authorization checks combine to make the files reachable by any visitor.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to the predictable export path on the target WordPress site. If a CSV export exists, the web server returns its contents. Attackers can enumerate likely paths, scan for .csv artifacts under the plugin's upload directory, or use search engine indexing to locate exposed files. No credentials, browser interaction, or chained vulnerabilities are required. See the WPScan Vulnerability Detail for the full technical write-up.

Detection Methods for CVE-2026-5335

Indicators of Compromise

Web server access logs showing GET requests to .csv files under the plugin's storage directory from external IP addresses
Search engine results indexing CSV exports from the affected WordPress site
Unexpected files in the wp-content/uploads/ tree with export-style filenames
Spikes in outbound CSV file transfers from the WordPress host

Detection Strategies

Audit the WordPress installation for the Magic Export & Import plugin and confirm the version is 1.2.0 or later
Search the web root for CSV files left behind by previous exports and review their contents for sensitive data
Review HTTP access logs for requests to plugin export paths originating from unauthenticated sessions
Use a vulnerability scanner with WPScan signatures to flag the plugin version

Monitoring Recommendations

Alert on unauthenticated requests to files matching *.csv under wp-content/uploads/
Monitor for crawler or scanner user-agents probing plugin-specific directories
Track file creation events in the export directory and correlate with administrator activity

How to Mitigate CVE-2026-5335

Immediate Actions Required

Update the Magic Export & Import plugin to version 1.2.0 or later
Delete any existing CSV exports from the plugin's storage directory if they are no longer needed
Rotate or notify users whose data may have been included in past exports
Review web server logs for prior unauthorized access to export files

Patch Information

The vendor addressed CVE-2026-5335 in Magic Export & Import version 1.2.0. Site administrators should apply the update through the WordPress plugin manager. Confirm remediation by verifying the plugin version and attempting to access a known export path without authentication. Refer to the WPScan Vulnerability Detail for advisory information.

Workarounds

Block direct access to the plugin's export directory using a web server rule such as an Apache .htaccessDeny from all or an equivalent Nginx location block
Move existing exports outside the web root and serve them only through an authenticated handler
Restrict access to wp-content/uploads/ subdirectories that contain generated exports until the plugin is updated

bash

# Configuration example: deny direct access to CSV exports under wp-content/uploads
# Apache .htaccess placed in the plugin export directory
<FilesMatch "\.csv$">
    Require all denied
</FilesMatch>

# Nginx equivalent in the server block
location ~* /wp-content/uploads/.*\.csv$ {
    deny all;
    return 403;
}