WP Ultimate CSV Importer CVE-2026-80488

Exploitation requires an authenticated session with WordPress administrator privileges (confirmed by PR:H in the CVSS vector). The attacker must have access to the CSV import feature within the WordPress admin dashboard. No special server-side configuration beyond a default WordPress installation with the WP Ultimate CSV Importer plugin active (versions before 9.0) is required. The primary limiting factor is the hard requirement for admin-level credentials, which prevents unauthenticated or low-privilege exploitation. Impact is constrained to confidentiality (C:L) with no integrity or availability component scored, suggesting read-oriented injection rather than data modification or denial of service.

Real-world risk is moderate-to-low despite the presence of a public exploit. The CVSS base score of 4.1 and vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) confirm the attack is network-reachable but strictly requires administrator-level authentication, restricting exploitation to trusted insiders or to scenarios where admin credentials have already been compromised via a separate vector. The EPSS score of 0.16% (5th percentile) is consistent with this high-privilege barrier limiting opportunistic mass exploitation. No active exploitation has been confirmed in CISA KEV. The public POC elevates theoretical risk but does not change the fundamental gating requirement of admin access. The impact is limited to low confidentiality exposure (C:L) with no integrity or availability impact scored, suggesting read-oriented SQL injection rather than destructive capability - though the full exploitation envelope should be validated against the POC.

An authenticated WordPress administrator uploads a specially crafted CSV file containing SQL injection payloads embedded in one or more field values. During the import process, the plugin passes these unsanitized values directly into a SQL query, allowing the attacker to append additional SQL clauses that extract sensitive data - such as password hashes, user emails, or other database contents - from the WordPress database. A public proof-of-concept for this technique is referenced in the WPScan advisory.