CVE-2026-45440: WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability
Published Oct 10, 2026
·Updated
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
Affected Software
1 affected component
Smackcoders WP Ultimate CSV Importer<=9.2
Event History
Oct 10, 2026
CVE Published
via MITRE·07:35 PM
Data Sourced
via MITRE·07:35 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker needs administrator-level privileges in WordPress. The issue is therefore primarily relevant where an administrator account is compromised or untrusted users have been granted administrator access.
2
Which installations are affected?
WP Ultimate CSV Importer versions 9.2 and earlier are affected according to the available information. The affected component is the Smackcoders WP Ultimate CSV Importer WordPress plugin.
3
What is the likely impact of successful exploitation?
Successful exploitation can expose sensitive data through SQL injection and may affect availability. The supplied severity vector also indicates that the impact can extend beyond the vulnerable plugin's security scope.