CVE-2026-45440

Summary

A SQL injection vulnerability in WP Ultimate CSV Importer plugin allows authenticated administrators to execute arbitrary SQL commands, potentially leading to full database compromise and unauthorized access to sensitive user data.

Exploitability

Exploitation requires an authenticated administrator account with access to the plugin's import functionality, making it moderately difficult but not highly complex to achieve.

Blast radius

If exploited, this vulnerability could allow attackers to extract all user credentials, personal information, and other sensitive data stored in the WordPress database, potentially affecting thousands of users.

Detection

Monitor for unusual database queries in the WordPress error logs that contain SQL injection patterns, particularly those involving the import functionality, and watch for unexpected administrative actions performed by authenticated users.

Prioritized remediation

Upgrade to WP Ultimate CSV Importer version 9.3 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.