EUVD-2026-54894
GHSA-2prc-6923-5fm5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Fully unauthenticated network injection with no complexity; scope change justified by cross-table DB read; no write or availability impact described.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.
AnalysisAI
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements in an SQL Command) is the root cause: a parameter - likely tied to the plugin's file-upload handling workflow - is concatenated into a SQL query without sanitization or parameterized binding. WordPress plugins interact directly with the wpdb abstraction layer; plugins that bypass prepared statements and construct raw queries are vulnerable to this class of flaw. The plugin is identified by EUVD as 'Iptanus File Upload' versions 0 through below 5.1.8. Because WordPress stores all plugin, user, and post data in a shared MySQL/MariaDB database, a successful injection can traverse the entire schema, not just the plugin's own records.
RemediationAI
The primary fix is to update the Iptanus File Upload plugin to version 5.1.8 or later, which the vendor has released as confirmed by WPScan (https://wpscan.com/vulnerability/364c99a4-4ce9-4e5f-bccc-2b4081e4031d/) and EUVD-2026-54894. If immediate upgrading is not possible, the most effective compensating control is to deactivate the plugin entirely until the patch can be applied - this eliminates the attack surface with no side effects other than loss of file-upload functionality. Alternatively, a web application firewall rule blocking SQL metacharacters (single quotes, UNION, SELECT keywords) in plugin-specific HTTP parameters can reduce exploitation probability, though WAF bypass techniques exist and this is not a substitute for patching. WordPress site administrators should also rotate the WordPress secret keys and salts after patching if there is any indication of prior exploitation, since admin password hashes may have been exposed. No patch version beyond 5.1.8 is independently verified from a vendor release note in the available data; the version comes from EUVD affected-range data.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today