WP Ultimate CSV Importer CVE-2026-45440

Exploitation requires an authenticated WordPress Administrator session on a site with WP Ultimate CSV Importer version 9.2 or earlier installed and active (PR:H confirms high-privilege requirement). The vulnerable code path is within the plugin's import/handling functionality accessible to administrators. The key limiting factor is the administrator precondition: this is not remotely exploitable by unauthenticated or low-privileged users, so realistic risk is confined to malicious administrators, compromised admin credentials, or privilege-escalation chains that first obtain an admin account. No end-user interaction is required (UI:N), and the default configuration is exploitable once the plugin is installed and the attacker is authenticated as admin.

This is a high-CVSS (7.6) but comparatively low-real-risk issue once the privilege requirement is factored in. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) confirms network reachability and low attack complexity, but PR:H means the attacker must already hold Administrator-level access to the WordPress site, which is the most privileged role available. A user who is already an administrator can typically read and manipulate the database through legitimate means, so the marginal risk added by this SQL injection is modest - its primary value is as a post-compromise or insider-abuse primitive, or for bypassing hardening that restricts direct DB access. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code; exploitation probability signals are entirely absent rather than low. The vendor-assigned Scope:Changed and Confidentiality:High reflect that SQL injection can expose data beyond the plugin's own boundary (the shared WordPress database), which is the main driver of the 7.6 score. Net assessment: patch in the normal cycle rather than as an emergency - the administrator precondition substantially limits real-world weaponization against hardened sites.

An authenticated attacker holding a WordPress Administrator account on a site running WP Ultimate CSV Importer 9.2 or earlier sends a crafted request to a vulnerable import/parameter handler, injecting SQL that is executed against the WordPress database. This lets them extract sensitive data such as password hashes, secret keys, or other users' records. No public exploit code or active exploitation was identified in the provided data, and the attack requires pre-existing administrator access.