CVE-2026-66447

CriticalCVSS 9.3

Published: 06/08/2026(UTC)Updated: 06/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Summary

The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.

Risk Assessment

The vulnerability allows an unauthenticated attacker to manipulate the database, potentially leading to data leakage or data integrity compromise.

Recommendation

It is recommended to update the WordPress File Upload plugin to a version newer than 5.1.7 to mitigate the vulnerability.

Original NVD description (English source)

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.