What is the CVSS score of CVE-2026-57628?

CVE-2026-57628 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP All Import are affected by CVE-2026-57628?

The WP All Import WordPress plugin (versions 4.0.1 and earlier) contains a SQL injection vulnerability that allows administrator-level users to extract sensitive database information beyond what the…

How to fix or mitigate CVE-2026-57628?

Within 24 hours: Audit all WordPress installations to identify those running WP All Import version 4.0.1 or earlier; review administrator account activity logs for the past 90 days. Within 7 days: Disable WP All Import plugin on non-critical sites; restrict administrator role to essential personnel only; enable database query auditing and logging. Within 30 days: Subscribe to WP All Import vendor security advisories; test and deploy any released patches to all affected systems.

WP All Import CVE-2026-57628

EUVD-2026-39744 HIGH

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-mf27-wm76-5323

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

5.5 MEDIUM

Requires an authenticated admin (PR:H) over the network with low complexity; SQLi yields full DB read (C:H), limited integrity impact (I:L), no scope change (S:U) since the database is the same security authority.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:50 vuln.today

DescriptionCVE.org

Administrator SQL Injection in WP All Import <= 4.0.1 versions.

AnalysisAI

SQL injection in the WP All Import WordPress plugin (versions 4.0.1 and earlier) allows an authenticated administrator to inject arbitrary SQL into backend database queries, enabling extraction of sensitive data beyond what the plugin UI exposes. The CVSS 3.1 vector (AV:N/AC:L/PR:H) confirms it is network-reachable but requires high privileges, and the original vector's S:C/C:H/A:L rates impact as elevated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

WP All Import is a WordPress plugin used to import structured data (CSV, XML) into WordPress posts, pages, users, and custom fields, performing many direct database operations during mapping and processing. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input handled within an administrative import workflow is concatenated into a SQL statement without adequate parameterization or escaping. No CPE strings were provided in the input, so the exact affected configurations are derived solely from the advisory's product/version scope (WP All Import <= 4.0.1) rather than NVD CPE enumeration.

RemediationAI

Upgrade WP All Import to a version later than 4.0.1 once the vendor publishes a fixed release; the provided data does not include an exact patched version, so confirm the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-all-import/vulnerability/wordpress-wp-all-import-plugin-4-0-1-sql-injection-vulnerability?_s_id=cve) before deploying. Because exploitation requires administrator privileges, the strongest compensating controls are tightening who holds admin: enforce least-privilege role assignment, require strong unique credentials and MFA on all administrator accounts, and audit existing admin users for unexpected entries (trade-off: operational overhead but no functional loss). As an interim control, restrict access to the WordPress admin dashboard (/wp-admin) by IP allowlist or VPN to shrink the attack surface (side effect: legitimate remote admins must connect through the allowed path), and consider a WAF rule set targeting SQLi patterns on plugin import endpoints (side effect: possible false positives on legitimate import payloads). Avoid disabling the plugin only if imports are business-critical; otherwise deactivating WP All Import until patched fully removes the exposure.