Description

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-08-29T06:17:49.663Z",
  "pubdate": "2026-08-29T06:17:49.663Z",
  "executiveSummary": "The WP Ultimate CSV Importer WordPress plugin, specifically versions prior to 9.0, is susceptible to a SQL injection (SQLi) vulnerability stemming from improper input sanitization.\nThis vulnerability allows an authenticated user with high privileges, such as an administrator, to manipulate SQL queries by injecting malicious payloads into imported field values.\nSuccessful exploitation permits an attacker to execute arbitrary SQL commands against the WordPress database, potentially leading to unauthorized data extraction, modification, or deletion.\nThe risk is categorized as critical within the context of the WordPress environment, as it bypasses standard database interaction controls.\nAlthough the attack requires authenticated access, it significantly elevates the threat posture by allowing an already high-privileged user to achieve deeper command execution or full database compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization and escaping of data processed during the CSV import workflow. When the WP Ultimate CSV Importer plugin processes imported field values, it fails to adequately treat these inputs as untrusted data before passing them directly into SQL statements.\nThe vulnerable component is the data parsing and database abstraction layer within the plugin, which handles the mapping and insertion of imported CSV data into the WordPress database tables.\nAn attacker with high-level privileges, such as an administrator, can craft a malicious CSV file where specific field values contain SQL syntax. Upon uploading and processing this file, the plugin constructs database queries using these unvalidated, attacker-supplied inputs.\nThe exploitation flow proceeds as follows: First, the attacker prepares a CSV file containing malicious SQL payloads within one of the importable fields. Second, the attacker utilizes the plugin's import functionality to upload and process this file. Third, the plugin's internal functions parse the CSV and fail to properly sanitize the malicious payload, directly concatenating it into a database query. Fourth, the underlying database driver executes the contaminated SQL statement, thereby allowing the attacker to execute arbitrary queries, potentially bypassing intended constraints or retrieving sensitive information from the database tables.\nThis vulnerability persists in all versions of the WP Ultimate CSV Importer plugin prior to 9.0. Because the injection occurs at the database query level, the post-exploitation impact includes full database compromise, which may lead to privilege escalation to the host server, exfiltration of administrative credentials, or persistent backdoor installation within the WordPress database."
}