What is GHSA-f9pm-pfcr-fr64?

GHSA-f9pm-pfcr-fr64 is a security advisory published by GitHub Security Advisories with Medium severity. The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it...

Which CVE IDs does GHSA-f9pm-pfcr-fr64 cover?

GHSA-f9pm-pfcr-fr64 covers the following CVE IDs: CVE-2026-111956. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f9pm-pfcr-fr64?

GHSA-f9pm-pfcr-fr64 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-f9pm-pfcr-fr64MediumCVSS 5.9

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-111956 →

📋 Description

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-111956
https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd
https://github.com/advisories/GHSA-f9pm-pfcr-fr64