CVE-2026-5335: Unknown Magic Export & Import

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.

Affected products

• Unknown Magic Export & Import: before 1.2.0 (fixed in 1.2.0)

Published 2026-05-04. Last modified 2026-06-17.