CVE-2026-62071

CriticalCVSS 9.3

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

The WordPress File Upload plugin in versions up to and including 5.1.10 contains an SQL injection vulnerability exploitable by an unauthenticated attacker.

Risk Assessment

An unauthenticated attacker can execute arbitrary SQL queries against the WordPress database, risking data leakage, modification, or deletion.

Recommendation

Update the WordPress File Upload plugin to a version later than 5.1.10 that contains the fix.

Other vulnerabilities in WordPress File Upload

See all

CVE-2026-66447Critical
The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.
CVE-2026-66570High
The WordPress File Upload plugin (Nickboss) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 5.2.1.

Original NVD description (English source)

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS