External risk intelligence

WordPress File Upload SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66447

The vulnerability exists in a WordPress plugin designed for file uploads, which are typically exposed as public-facing web components. As an unauthenticated SQL injection vulnerability in a web-based plugin, it is directly reachable by internet users in standard deployment configurations.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves an unauthenticated SQL injection flaw in a WordPress plugin that handles file uploads. The issue could allow unauthorized access to or manipulation of data stored in the website's database.

Unauthenticated database access in a WordPress plugin.
Public-facing plugins are common targets for attackers.
Confirm relevance and potential exposure for our sites.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending a specially crafted request to a WordPress site using the vulnerable File Upload plugin. Since no authentication is required, any internet-connected user can send this request to the website. If successful, the attacker could trigger a database-related issue, potentially leading to unauthorized access to sensitive information or disruption of the site's database.

No authentication needed to access.
Triggered by crafted web requests.
Risk of data exposure or disruption.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated SQL injection in the WordPress File Upload plugin could allow an attacker to access or manipulate database information. This vulnerability could affect the integrity and availability of data stored within the WordPress database when the plugin is used.

Database information.
Unauthenticated network access.
Data corruption or unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in a WordPress file upload plugin requires immediate attention from teams managing web applications and their infrastructure. The first practical step is to locate all instances of this plugin, determine their exposure to the internet, and confirm their business criticality to prioritize remediation efforts. Accountable owners must be identified to initiate the update or mitigation process.

Identify application and infrastructure owners.
Verify plugin presence and external reachability.
Plan coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WordPress File Upload plugin?

The WordPress File Upload plugin is an add-on component used to enable file management and document storage capabilities directly within a WordPress site. It acts as a bridge, allowing site visitors or administrators to upload media or documents to the server. Because it directly processes input and interacts with the site's underlying database to manage these files, it serves as a critical interface between external users and the website's backend infrastructure.

What does CVE-2026-66447 mean for the plugin's security?

This CVE identifies an SQL Injection vulnerability, categorized under CWE-89. This weakness occurs when software does not properly sanitize user-supplied data before including it in a database query. In the context of this plugin, it means an attacker can manipulate the underlying database commands, potentially allowing them to view or interfere with sensitive data without needing authorized access.

How is this SQL injection triggered?

An attacker triggers this vulnerability by sending a specially crafted web request to the server that the plugin processes. Because the flaw is unauthenticated, no login or special user privileges are required to initiate the attack. Crucially, simply browsing the site or loading static pages normally does not trigger the bug; the malicious input must be explicitly embedded in the specific requests handled by the plugin's vulnerable code paths.

Is my site at risk from this vulnerability?

Halo Surface Signal indicates this vulnerability is very likely to be reachable because the plugin is designed to process web-based uploads, which are typically exposed as public-facing components. If your site uses this plugin and is accessible to internet users, your application is exposed. Internal-only applications with restricted access may have a lower immediate risk, but any instance reachable via the public internet should be considered a priority.

What should I do if I use this WordPress plugin?

Your first step is to perform an inventory of your WordPress installations to confirm if the affected version (5.1.7 or earlier) is active. Once identified, work with your web administration team to verify the plugin's external reachability. Prioritize these systems for updates or temporary mitigation, and ensure you have designated owners ready to coordinate the necessary security patches to prevent database-level compromise.

References

patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.