CVE-2026-62071

CriticalCVSS 9.3

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

The WordPress File Upload plugin in versions up to and including 5.1.10 contains an SQL injection vulnerability exploitable by an unauthenticated attacker.

Risk Assessment

An unauthenticated attacker can execute arbitrary SQL queries against the WordPress database, risking data leakage, modification, or deletion.

Recommendation

Update the WordPress File Upload plugin to a version later than 5.1.10 that contains the fix.

Other vulnerabilities in WordPress File Upload

CVE-2026-66447Critical
The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.

Original NVD description (English source)

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS