What is the CVSS score of CVE-2026-66447?

CVE-2026-66447 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of WordPress File Upload are affected by CVE-2026-66447?

The WordPress File Upload plugin (versions through 5.1.7) contains a critical SQL injection vulnerability requiring no user authentication, allowing any internet-connected attacker to extract the…

How to fix or mitigate CVE-2026-66447?

Within 24 hours: immediately deactivate the WordPress File Upload plugin across all affected installations. Within 7 days: completely remove the plugin, implement Web Application Firewall (WAF) or ModSecurity rules to block SQL injection patterns targeting WordPress upload handlers, and audit database access logs for exploitation evidence. Within 30 days: deploy an alternative file upload solution, monitor vendor channels for a patched plugin version, and conduct security audit of affected sites to determine whether database access has occurred.

WordPress File Upload CVE-2026-66447

EUVD-2026-53883 CRITICAL

SQL Injection (CWE-89)

2026-08-06 Patchstack

GHSA-jjw2-9c4x-8mhg

WordPress SQLi File Upload Wordpress File Upload Wordpress Plugin

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated, low-complexity network SQLi yields high confidentiality (DB read) and some integrity via injection; scope kept Unchanged as impact stays within the WordPress database authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:43 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.

AnalysisAI

SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is reachable by unauthenticated remote attackers (CVSS 9.3, AV:N/PR:N). Because the CVSS scope is Changed with high confidentiality impact, a crafted request can coerce the plugin into executing attacker-controlled SQL, exposing WordPress database contents such as user records and secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Patchstack.

Technical ContextAI

The affected component is the WordPress File Upload plugin (CPE cpe:2.3:a:nickboss:wordpress_file_upload), a third-party add-on that adds front-end file-upload forms to WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a database query without proper parameterization or escaping. Because WordPress plugins typically run queries through the global $wpdb layer, an injection here can read arbitrary tables in the shared WordPress database rather than being confined to the plugin's own data.

RemediationAI

Upgrade the WordPress File Upload plugin to the first release above 5.1.7 that contains the fix; the input data does not specify an exact patched version, so confirm the fixed release directly on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-1-7-sql-injection-vulnerability) and the plugin's WordPress.org changelog before deploying. If an update cannot be applied immediately, deactivate the plugin (removing its upload forms but eliminating the attack surface), or place a WAF rule / virtual patch in front of the plugin's upload endpoints to block SQL metacharacters in the vulnerable parameters - accepting that WAF signatures can be bypassed and are a stopgap, not a fix. Restricting or gating the front-end upload form behind authentication also reduces exposure but changes site functionality for anonymous users.