CyberRota Analysis
AI-GeneratedThe WP Ultimate CSV Importer plugin for WordPress versions prior to 9.2 is vulnerable due to the lack of a site-specific secret for determining the storage location of import logs, which are stored in the uploads directory without access restrictions. This oversight allows unauthenticated attackers to access and potentially exfiltrate personal data of users imported via CSV files. WordPress site administrators using this plugin should prioritize updating to version 9.2 or later to mitigate the risk of data exposure.
Original NVD Description
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.