WordPress File Upload CVE-2026-66447

Exploitation requires that the WordPress File Upload plugin (≤ 5.1.7) be installed and active, with its file-upload form/endpoint reachable by the attacker - the typical deployment, since the plugin exists to expose front-end upload forms. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is needed: any site presenting the plugin's upload interface to unauthenticated visitors is exploitable. The main limiting factors are whether the plugin is installed at a vulnerable version and whether the vulnerable form is exposed to anonymous users rather than gated behind login or access controls.

The signals point to a genuine high priority rather than an inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, score 9.3) describes a low-complexity, unauthenticated, network-reachable injection with a scope change and high confidentiality impact - the worst-case profile for a public-facing plugin. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here, and there is no KEV listing or confirmed POC, so exploitation appears theoretical for now. That said, SQLi in widely installed WordPress plugins is historically a favored, easily automated target once details are public, so the absence of a POC should be treated as a short-lived window, not a reassurance. One inconsistency worth noting: the vendor vector sets I:N and A:L, which is unusual for SQLi (injection often permits at least some write or DoS potential); verify actual impact against the Patchstack advisory.

An unauthenticated attacker locates a WordPress site running WordPress File Upload ≤ 5.1.7 and sends a crafted request to the plugin's upload-handling endpoint with malicious SQL embedded in a vulnerable parameter. The injected query executes against the WordPress database, letting the attacker enumerate and exfiltrate sensitive data such as usernames, password hashes, and session or API secrets. No public exploit is currently identified, but the low attack complexity makes weaponization straightforward once the vulnerable parameter is known.