---
id: "CVE-2026-126640"
page: "https://infrastack.ai/live/CVE-2026-126640"
kind: "vulnerability"
aliases: ["CVE-2026-126640"]
title: "WP Ultimate CSV Importer: imported files reach SQL queries unescaped, enabling injection"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["lifterlms", "multisite", "package", "wordpress", "wp-ultimate-csv-importer"]
not_affected_if: ["lifterlms-not-used", "no-admin-user-exposure", "plugin-version-9.3-or-later"]
published_at: "2026-11-14T07:17:20+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:28:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126640", "first_seen_at": "2026-11-14T07:27:45+00:00"}]
exploit_sources: []
---

# WP Ultimate CSV Importer: imported files reach SQL queries unescaped, enabling injection

Link for people: https://infrastack.ai/live/CVE-2026-126640 (this .md is for agents)

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries during LifterLMS content imports. A high-privilege user such as an administrator, including a single-site administrator on a multisite network, can run SQL injection attacks against the site database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/` for the WP Ultimate CSV Importer plugin.
- Check whether the LifterLMS plugin is active, since the flaw is in its import path.

## Fix

- WP Ultimate CSV Importer: move to `9.3` or later (the sources state the fix is in 9.3).

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126640

## From the sources

The WP Ultimate CSV Importer  WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_