{"id":"CVE-2026-45440","published":"2026-10-10T20:16:37.740","lastModified":"2026-10-13T13:28:15.717","description":"Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-ultimate-csv-importer/vulnerability/wordpress-wp-ultimate-csv-importer-plugin-9-2-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in WP Ultimate CSV Importer plugin allows authenticated administrators to execute arbitrary SQL commands, potentially leading to full database compromise and unauthorized access to sensitive user data.","exploitability":"Exploitation requires an authenticated administrator account with access to the plugin's import functionality, making it moderately difficult but not highly complex to achieve.","blast_radius":"If exploited, this vulnerability could allow attackers to extract all user credentials, personal information, and other sensitive data stored in the WordPress database, potentially affecting thousands of users.","remediation":"Upgrade to WP Ultimate CSV Importer version 9.3 or later to remediate this SQL injection vulnerability.","detection":"Monitor for unusual database queries in the WordPress error logs that contain SQL injection patterns, particularly those involving the import functionality, and watch for unexpected administrative actions performed by authenticated users.","tags":["sql-injection","wordpress","admin-access","database"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:23.240Z"}}