CVE-2026-126640 · Package
NO FIX YET · SEE WHAT TO DO
The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries during LifterLMS content imports. A high-privilege user such as an administrator, including a single-site administrator on a multisite network, can run SQL injection attacks against the site database.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the WP Ultimate CSV Importer plugin before 9.3 that import LifterLMS content. The risk needs an administrator-level account, so sites that restrict admin access tightly have less exposure. unknown whether sites without LifterLMS are affected.
Not affected if lifterlms-not-used, no-admin-user-exposure, plugin-version-9.3-or-later
Who cares lifterlms, multisite, wordpress, wp-ultimate-csv-importer
wp-content/plugins/ for the WP Ultimate CSV Importer plugin.9.3 or later (the sources state the fix is in 9.3).The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.