{"id":"CVE-2026-126640","kind":"vulnerability","aliases":["CVE-2026-126640"],"related":[],"title":"WP Ultimate CSV Importer: imported files reach SQL queries unescaped, enabling injection","description":"The WP Ultimate CSV Importer  WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks.","summary":"The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries during LifterLMS content imports. A high-privilege user such as an administrator, including a single-site administrator on a multisite network, can run SQL injection attacks against the site database.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lifterlms","multisite","package","wordpress","wp-ultimate-csv-importer"],"not_affected_if":["lifterlms-not-used","no-admin-user-exposure","plugin-version-9.3-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/` for the WP Ultimate CSV Importer plugin.\n- Check whether the LifterLMS plugin is active, since the flaw is in its import path.","fix":"- WP Ultimate CSV Importer: move to `9.3` or later (the sources state the fix is in 9.3).","status":"open","published_at":"2026-11-14T07:17:20+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:08+00:00","updated_at":"2026-11-14T07:28:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T07:28:08Z","model":"claude-haiku-5-5","output":{"fix":"- WP Ultimate CSV Importer: move to `9.3` or later (the sources state the fix is in 9.3).","reach":"internet","title":"WP Ultimate CSV Importer: imported files reach SQL queries unescaped, enabling injection","impact":"medium","summary":"The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries during LifterLMS content imports. A high-privilege user such as an administrator, including a single-site administrator on a multisite network, can run SQL injection attacks against the site database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-ultimate-csv-importer","lifterlms","multisite"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Admin-level user runs SQL injection against the WordPress database","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/` for the WP Ultimate CSV Importer plugin.\n- Check whether the LifterLMS plugin is active, since the flaw is in its import path.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-9.3-or-later","lifterlms-not-used","no-admin-user-exposure"],"who_is_affected":"Sites running the WP Ultimate CSV Importer plugin before 9.3 that import LifterLMS content. The risk needs an administrator-level account, so sites that restrict admin access tightly have less exposure. unknown whether sites without LifterLMS are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4545,"output_tokens":628,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126640':15A,18A '-2026':14A,17A '9.3':36B,90C 'admin':114C 'administr':62B,68B,117C 'allow':108C 'attack':77B,130C 'content':52B,107C 'csv':3A,26B,31B,85C 'cve':13A,16A 'databas':81B 'enabl':11A 'escap':39B,93C 'file':6A,43B,97C 'high':56B,109C 'high-privileg':55B 'import':4A,5A,27B,32B,42B,53B,86C,96C,105C 'includ':63B,115C 'inject':12A,76B,129C 'lifterlm':19B,51B,106C 'multisit':20B,71B,124C 'network':72B,125C 'packag':21B 'perform':127C 'plugin':34B,88C 'privileg':57B,110C 'queri':9A,49B,103C 'reach':7A 'run':74B 'singl':66B,120C 'single-sit':65B 'site':67B,80B,121C 'sql':8A,48B,75B,102C,128C 'ultim':2A,25B,30B,84C 'unescap':10A 'use':45B,99C 'user':58B,111C 'valu':40B,94C 'wordpress':22B,33B,87C 'wp':1A,24B,29B,83C 'wp-ultimate-csv-import':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Ultimate CSV Importer plugin before 9.3 that import LifterLMS content. The risk needs an administrator-level account, so sites that restrict admin access tightly have less exposure. unknown whether sites without LifterLMS are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["lifterlms","medium","multisite","package","wordpress","wpultimatecsvimporter"],"campaign_type":null,"search_a":"'-126640':15A,18A '-2026':14A,17A 'csv':3A 'cve':13A,16A 'enabl':11A 'file':6A 'import':4A,5A 'inject':12A 'queri':9A 'reach':7A 'sql':8A 'ultim':2A 'unescap':10A 'wp':1A","search_b":"'9.3':36B 'administr':62B,68B 'attack':77B 'content':52B 'csv':26B,31B 'databas':81B 'escap':39B 'file':43B 'high':56B 'high-privileg':55B 'import':27B,32B,42B,53B 'includ':63B 'inject':76B 'lifterlm':19B,51B 'multisit':20B,71B 'network':72B 'packag':21B 'plugin':34B 'privileg':57B 'queri':49B 'run':74B 'singl':66B 'single-sit':65B 'site':67B,80B 'sql':48B,75B 'ultim':25B,30B 'use':45B 'user':58B 'valu':40B 'wordpress':22B,33B 'wp':24B,29B 'wp-ultimate-csv-import':23B","search_c":"'9.3':90C 'admin':114C 'administr':117C 'allow':108C 'attack':130C 'content':107C 'csv':85C 'escap':93C 'file':97C 'high':109C 'import':86C,96C,105C 'includ':115C 'inject':129C 'lifterlm':106C 'multisit':124C 'network':125C 'perform':127C 'plugin':88C 'privileg':110C 'queri':103C 'singl':120C 'site':121C 'sql':102C,128C 'ultim':84C 'use':99C 'user':111C 'valu':94C 'wordpress':87C 'wp':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126640","severity":null,"published_at":"2026-11-14T07:17:20+00:00","modified_at":"2026-11-14T07:17:20+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}