Description

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-06T15:17:20.207Z",
  "pubdate": "2026-08-06T15:17:20.207Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in the WordPress File Upload plugin affecting versions <= 5.1.7. This security flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL payloads into vulnerable input parameters processed by the plugin. Successful exploitation of this vulnerability can lead to unauthorized database access, potential extraction of sensitive information including user credentials and configuration data, data modification, or complete compromise of the underlying WordPress database. The vulnerability poses a severe risk to confidentiality, integrity, and availability due to the lack of authentication requirements, enabling adversaries to execute arbitrary database commands remotely over the network without prior access or privileged roles.",
  "technicalDetails": "The vulnerability resides within the request handling and database interaction logic of the WordPress File Upload plugin, specifically in versions <= 5.1.7. The root cause stems from insufficient input sanitization, lack of proper parameterization, and inadequate escaping of user-supplied data before incorporating it into database queries executed via the WordPress database abstraction layer (wpdb). Because the application fails to enforce authentication checks or validate user input against a strict whitelist prior to database operations, unauthenticated remote attackers can supply crafted SQL statements via HTTP request parameters.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies an exposed endpoint or AJAX handler associated with the WordPress File Upload plugin that accepts parameters destined for database interaction. Second, the attacker crafts a malicious HTTP GET or POST request containing SQL injection payloads designed to manipulate the logical structure of the backend database query. Third, the vulnerable component processes the input without adequate sanitization or prepared statements, directly concatenating the malicious payload into the SQL execution string. Finally, the database server parses and executes the altered query, returning sensitive data or executing unauthorized database modifications depending on the injected payload and the privileges associated with the database connection.\nNetwork exposure is fully external, as the vulnerable parameters are reachable over standard HTTP/HTTPS protocols without requiring user sessions. Authentication and privilege requirements are entirely absent, allowing any anonymous network adversary to trigger the flaw. Post-exploitation impact includes unauthorized data exfiltration, enumeration of database contents, potential privilege escalation by modifying user roles within the WordPress database, and in certain configurations, interaction with the underlying operating system if database features allow."
}