CVE-2026-126640
WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks.
| Vendor | unknown |
| Product | wp ultimate csv importer |
| Published | Nov 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp ultimate csv importer
Be the first to know when new unknown vulnerabilities affecting unknown wp ultimate csv importer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Ultimate CSV Importer
0 < 9.3
References
Credits
Raphael P. Cigana WPScan