IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
Ohne Score

CVE-2026-126640WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

WP Ultimate CSV Importer Veröffentlicht: (vor 1 Stunde)

Beschreibung

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks.

Schwachstellentyp (CWE): CWE-89

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
— WP Ultimate CSV Importer < 9.3

Referenzen und Patches

Neue CVEs im selben Produkt — WordPress plugins & themes

Ohne Score
CVE-2026-119258

Swipe <= 1.4 - Unauthenticated Authentication Bypass

Swipe

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.

Ohne Score
CVE-2026-123046

SEOJuice < 2.12.0 - Administrator Account Creation via CSRF

SEOJuice

The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, in…