CVE-2026-80488: WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

Q: Who can exploit this issue?

Exploitation requires a high-privilege WordPress user, such as an administrator, who can supply imported field values.

Q: Which installations are affected?

WP Ultimate CSV Importer versions before 9.0 are affected. The issue is associated with AIOSEO import fields.

Q: What is the remediation?

Update WP Ultimate CSV Importer to version 9.0 or later.

Published Aug 29, 2026

Updated

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

Affected Software

1 affected component

WP Ultimate CSV Importer WordPress plugin<9.0

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires a high-privilege WordPress user, such as an administrator, who can supply imported field values.

Which installations are affected?

WP Ultimate CSV Importer versions before 9.0 are affected. The issue is associated with AIOSEO import fields.

What is the remediation?

Update WP Ultimate CSV Importer to version 9.0 or later.

CVE-2026-80488: WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What is the remediation?