SQL Injection Vulnerability in WP Ultimate CSV Importer for WordPress
CVE-2026-126640

Currently unrated

Key Information:

Vendor

WordPress
Status
WP Ultimate Csv Importer
Vendor
CVE Published:
14 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-126640?

The WP Ultimate CSV Importer plugin for WordPress, prior to version 9.3, is susceptible to SQL injection due to inadequate escaping of imported file values. This vulnerability allows privileged users, such as site administrators in single or multisite environments, to inject malicious SQL queries while importing content for LifterLMS. Consequently, attackers can manipulate the database, potentially compromising the integrity and security of the site.

Affected Version(s)

WP Ultimate CSV Importer 0 < 9.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-126640 - Proof of Concept

References

https://wpscan.com/vulnerability/95bbf4ab-c0aa-4d6c-b2fa-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphael P. Cigana
WPScan
.