CVE-2026-125912

The WP Ultimate CSV Importer WordPress plugin versions before 9.2 is vulnerable to arbitrary PHP code execution within the shared WordPress context. The root cause is a failure to restrict the destination filename and extension, as well as a lack of validation for the fetched content type during ...