SQL Injection Vulnerability in WP Import Ultimate CSV XML Importer Plugin for WordPress
CVE-2026-1317

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WP Ultimate Csv Importer – Import Csv, Xml & Excel Into WordPress
Vendor
CVE Published:
18 February 2026

What is CVE-2026-1317?

The WP Import – Ultimate CSV XML Importer for WordPress has a vulnerability allowing SQL Injection due to improper escaping on the file_name parameter. This issue affects all versions up to 7.37, enabling authenticated users with Subscriber-level access and above to manipulate SQL queries through malicious file names. Sensitive database information could be extracted if the 'Single Import/Export' option is active and the server is running PHP version lower than 8.0. Proper sanitization measures are crucial to mitigate this exploit.

Affected Version(s)

WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress 0 <= 7.37

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-ultimate-cs...
https://plugins.trac.wordpress.org/browser/wp-ultimate-cs...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dieu Link
GCSC Vietnam
.