EUVD-2026-90852
GHSA-84fg-9m65-7rf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WP site with plugin ≤5.1.10
-
DeliverySend crafted request with SQL payload
-
ExploitInjection executes against WordPress DB
-
ExecutionExtract credentials/sensitive rows
-
ImpactEscalate to site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the WordPress File Upload plugin (nickboss) at version 5.1.10 or earlier be installed and network-reachable; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication requirement, no user interaction, and no non-default configuration noted - exploitation targets default installations. The primary limiting factor is simply having a vulnerable plugin version present and the injectable endpoint exposed to the attacker; no special feature toggle or deployment mode is cited in the advisory. |
| Impact | This is a genuinely high-priority flaw by its technical profile. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, network-reachable, low-complexity SQL injection requiring no user interaction - the easiest class of web vulnerability to weaponize and automate. The 9.3 score is elevated by a scope change (S:C) and C:H, consistent with reading sensitive database contents (WordPress user credentials, hashes, session/API data) across a trust boundary. However, several corroborating risk signals are absent from the input: no EPSS probability, no CISA KEV listing, and no indication of public exploit code. Per precision rules this is 'no public exploit identified at time of analysis' - not active exploitation. The vendor-assigned I:N/A:L is conservative for CWE-89 (classic SQL injection frequently permits data modification and is easily automated), so the real-world integrity impact may be understated. Net: treat as a high-urgency patch item because unauthenticated SQLi in a WordPress plugin is a prime target for mass, automated scanning even absent a currently-cataloged exploit - but note the exploitation-probability signals (EPSS/KEV/POC) are simply missing, not confirmed low. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable WordPress File Upload plugin endpoint, injecting SQL into an unsanitized parameter to extract data directly from the WordPress database (e.g., administrator password hashes or session tokens). Because no authentication or user interaction is required, the request can be fired by automated scanners against any exposed site running version 5.1.10 or earlier. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.
RemediationAI
No vendor-released patch or explicit fixed version is identified in the provided data; the advisory scopes the issue to WordPress File Upload 5.1.10 and earlier, so the first action is to check the plugin's WordPress.org page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-1-10-sql-injection-vulnerability) for the current release and update to the newest available version, treating any release above 5.1.10 as unverified until the vendor confirms the fix. If no update is published or it cannot be deployed immediately, the most effective compensating control is to deactivate the plugin entirely, which removes the injectable code path at the cost of losing the upload functionality; where the plugin is business-critical, deploy a virtual patch at the WAF or reverse proxy to block SQL metacharacters and unexpected parameters on the plugin's request handlers (typically requests routed through wp-admin/admin-ajax.php and the plugin's own endpoints), accepting that generic SQLi signatures produce false positives on legitimate file-upload traffic and must be tuned. Additionally, restrict or monitor access to those endpoints at the edge, review database and web server logs for anomalous SQL in request parameters, and rotate WordPress user credentials and salts if compromise is suspected, since SQL injection exposure can leak password hashes and session data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, in the nickboss WordPress File Upload plugin, which ships as a standard WordPress plugin installed under wp-content/plugins and therefore inherits the site's MySQL/MariaDB database access via the WordPress $wpdb layer. The vulnerable code path builds a SQL statement from attacker-controlled request parameters instead of using prepared statements with placeholders, and because the reachable code path is registered for unauthenticated requests (PR:N in the assessed vector), the injection can be triggered without any WordPress account or login. The CPE cpe:2.3:a:nickboss:wordpress_file_upload:*:*:*:*:*:*:*:* uses a wildcard version, meaning every release of the plugin is treated as potentially in scope and the actual boundary is defined by the advisory's "<= 5.1.10" statement rather than by the CPE. Our assessment (S:U/C:H/I:L/A:N) treats the impact as confined to the vulnerable component with database read-out as the dominant risk and no loss of availability, whereas the vendor-reported vector additionally claims scope change and low availability impact, a difference consistent with assumptions about stacked queries or database-level privileges that we did not confirm; in either reading, the confidentiality of the WordPress database is the primary exposure, since SQL injection in a WordPress plugin frequently yields user credential hashes, session tokens, and private content.
Know when Wordpress File Upload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated remote SQLi gives AV:N/AC:L/PR:N/UI:N and C:H for database read; I:L reflects plausible data modification, and I keep S:U absent evidence of a true cross-component scope break.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.
Executive ViewAI
An unauthenticated SQL injection flaw in the WordPress File Upload plugin (nickboss) affects every site running version 5.1.10 or earlier, allowing any attacker who can reach the site to read arbitrary data from the underlying WordPress database without logging in. Because no vendor fix currently exists, the exposure persists until the plugin is removed or virtual patching is deployed, and any site hosting customer records, user accounts, or regulated data in its WordPress database should be treated as a potential data-disclosure incident in waiting. Leadership should care because the affected data set typically includes user credential hashes and personal information, creating breach-notification, credential-reuse, and reputational risk even in the absence of confirmed exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and uninstall the nickboss WordPress File Upload plugin (versions 5.1.10 and earlier) from all affected sites; if the functionality is required, restrict access to the plugin's upload endpoint by authentication, IP allowlisting, or network segmentation; deploy WAF/virtual-patching signatures blocking SQL injection patterns against the plugin's parameters; enable database and web server logging and monitor for anomalous query or read activity; rotate WordPress salts, administrator credentials, and database-stored secrets as a precaution; verify network reachability of affected sites and reduce unnecessary internet exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
More in Wordpress File Upload
View allThe WordPress File Upload plugin through version 4.24.15 contains critical vulnerabilities in wfu_file_downloader.php en
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. Rated critical severity (CVSS 9.8), this
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it b
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. Rate
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. Rated medium severi
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is re
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2
Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for Wo
Exploit-DB