CVE-2026-80488

MediumCVSS 4.1

Published: 29/08/2026(UTC)Updated: 30/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

Risk Assessment

SQL injection attacks can lead to full database compromise, including data theft, modification, or deletion, and takeover of the website.

Recommendation

It is recommended to update the WP Ultimate CSV Importer plugin to version 9.0 or later, which includes fixes for data sanitization and escaping.

Other vulnerabilities in WP Ultimate CSV Importer

CVE-2026-13353High
The WP Ultimate CSV Importer plugin for WordPress up to version 8.0.1 is vulnerable to Remote Code Execution via the 'MappedFields' parameter. Missing capability checks on AJAX handlers and exposure of the plugin nonce to any authenticated user allow a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in MappedFields, and trigger eval() in ImportHelpers::get_meta_values().

Original NVD description (English source)