The WholesaleX WordPress plugin stores the file that contains imported user data in a publicly accessible location under a predictable name. Because the plugin does not protect or delete the CSV file, an unauthenticated user can retrieve it. The CSV includes account passwords and detailed customer contact and address information, allowing the attacker to obtain sensitive credentials and personally identifiable information.

WordPress installations that run the WholesaleX plugin with a version earlier than 3.0.9 are affected. No other vendors or products are listed for this vulnerability.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation is straightforward: an attacker needs only to know the predictable file URL and can download the CSV with no authentication. While a CVSS score has not been assigned, the ability to retrieve passwords and personal data indicates a high confidentiality and privacy impact.