CVE-2026-5335

The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-05-04

Last modified

2026-05-04

Weaknesses

CWE-552

Affected products

• Magic Export Import (Unknown)

References

• https://wpscan.com/vulnerability/ed6f00de-bbae-4e89-9d0e-ded0d70e781c/