SQL Injection Vulnerability in WP Ultimate CSV Importer Plugin
CVE-2026-80488
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-80488?
The WP Ultimate CSV Importer plugin for WordPress prior to version 9.0 has a vulnerability that arises from improper sanitization and escaping of imported field values. This flaw can be exploited by high-privilege users, such as administrators, allowing them to execute arbitrary SQL commands. Successful exploitation may lead to unauthorized access to sensitive data or manipulation of the database, highlighting the need for users to promptly update to the latest version to mitigate this risk.
Affected Version(s)
WP Ultimate CSV Importer 0 < 9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.