CVE-2026-111956
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 21, 2026
Vendor
unknown
Description
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.