CVE-2026-66447
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.
Risk Assessment
The vulnerability allows an unauthenticated attacker to manipulate the database, potentially leading to data leakage or data integrity compromise.
Recommendation
It is recommended to update the WordPress File Upload plugin to a version newer than 5.1.7 to mitigate the vulnerability.
Other vulnerabilities in WordPress File Upload
See all- CVE-2026-62071Critical
The WordPress File Upload plugin in versions up to and including 5.1.10 contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-66570High
The WordPress File Upload plugin (Nickboss) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 5.2.1.
Original NVD description (English source)
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS