CVE-2026-125912

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.2

Description An issue exists when importing remote media where the plugin fails to restrict the destination filename and extension or validate the fetched content type. This allows an Administrator of a Multisite subsite to write and execute arbitrary PHP code within the shared WordPress context, even if they are not a Network Administrator and lack permissions to install plugins or edit files.

Recommendations Update WP Ultimate CSV Importer to version 9.2 or later.