IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
Sin puntuación

CVE-2026-126640WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

WP Ultimate CSV Importer Publicada: (hace 2 horas)

Descripción

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks.

Debilidad (CWE): CWE-89

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
— WP Ultimate CSV Importer < 9.3

Referencias y parches

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación
CVE-2026-119258

Swipe <= 1.4 - Unauthenticated Authentication Bypass

Swipe

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.

Sin puntuación
CVE-2026-123046

SEOJuice < 2.12.0 - Administrator Account Creation via CSRF

SEOJuice

The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, in…