CVE-2026-80518: WP CSV Importer Data Exposure Vulnerability

CVE-2026-80518 Overview

CVE-2026-80518 affects the WP Ultimate CSV Importer WordPress plugin in versions before 9.2. The plugin writes import logs to the WordPress uploads directory without using a site-specific secret to derive the storage path. The plugin also fails to block direct HTTP access to these log files. Unauthenticated attackers can retrieve personal data of users imported from CSV files by guessing or discovering the predictable log file paths. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can retrieve personally identifiable information (PII) imported through CSV files, exposing user data stored in log files under the WordPress uploads directory.

Affected Products

WP Ultimate CSV Importer WordPress plugin versions before 9.2
WordPress sites with vulnerable plugin installed and prior CSV imports
Any site storing personal data via this plugin's import workflow

Discovery Timeline

2026-10-03 - CVE-2026-80518 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-80518

Vulnerability Analysis

The WP Ultimate CSV Importer plugin generates import log files containing records of CSV data processed during user imports. These logs are written under the WordPress uploads directory, which is served directly by the web server. The plugin derives the log storage location using predictable values rather than a site-specific secret. Attackers who determine or enumerate the log path can fetch its contents over HTTP without authentication. The exposed data includes personal fields from imported CSV rows such as names, email addresses, and other user attributes.

Root Cause

The vulnerability stems from two combined weaknesses in the plugin's log handling. First, the plugin does not incorporate a site-specific secret (such as a cryptographic nonce tied to wp_salt() or a per-install random value) into the log filename or directory path. Second, the plugin does not place an .htaccess restriction, a index.php guard, or a server-level access control in the log directory. The resulting predictable, publicly-accessible paths allow direct retrieval of sensitive content.

Attack Vector

An unauthenticated remote attacker enumerates or guesses the log file path under /wp-content/uploads/. The attacker issues a standard HTTP GET request against the predicted URL. If the file exists, the web server returns its contents, including CSV-derived personal data. The high attack complexity reflects the need to determine the correct path without site-specific entropy, but no credentials or user interaction are required.

No verified exploit code is publicly available for this issue. For technical details, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-80518

Indicators of Compromise

Unauthenticated GET requests to /wp-content/uploads/ paths referencing CSV import log filenames
Repeated 200 OK responses to directory enumeration attempts targeting the uploads folder
Access log entries with non-browser user agents retrieving .log, .txt, or .csv files under uploads
Outbound data flows to unexpected IPs following enumeration bursts against the uploads directory

Detection Strategies

Audit the WordPress uploads directory for log files containing CSV import records or PII fields
Review web server access logs for anomalous requests targeting plugin-generated artifacts under uploads
Deploy web application firewall (WAF) rules that block direct access to log file extensions in the uploads path
Correlate plugin version inventory with sites running WP Ultimate CSV Importer below 9.2

Monitoring Recommendations

Alert on bulk 200 OK responses to unauthenticated requests under /wp-content/uploads/
Monitor for scanner signatures probing WordPress plugin artifact paths
Track file creation events in the uploads directory for new log files containing user PII

How to Mitigate CVE-2026-80518

Immediate Actions Required

Upgrade WP Ultimate CSV Importer to version 9.2 or later on all WordPress installations
Identify and delete existing import log files from the wp-content/uploads/ directory
Block direct HTTP access to log files via web server configuration or .htaccess rules
Notify affected users if logs containing PII were accessible, per applicable data protection regulations

Patch Information

The plugin vendor addressed the issue in WP Ultimate CSV Importer version 9.2. The fix introduces a site-specific secret when deriving log storage locations and blocks direct access to the log files. Site administrators should update through the WordPress plugin dashboard or by replacing plugin files manually. See the WPScan Vulnerability Report for additional detail.

Workarounds

Deny direct access to log files by adding a restrictive .htaccess rule in the uploads directory
Move or delete pre-existing log files from publicly served paths until the plugin is updated
Deactivate WP Ultimate CSV Importer until version 9.2 can be deployed if logs cannot be secured

bash

# Example .htaccess rule to block direct access to log files under uploads
<FilesMatch "\.(log|csv|txt)$">
    Require all denied
</FilesMatch>