CVE-2026-62071: Unauthenticated SQL Injection in WordPress File Upload Plugin
ID: 088161bf-2c02-5772-884c-1d17f375712e
STIX ID: report--088161bf-2c02-5772-884c-1d17f375712e
Feed Name: CosmicBytez Labs
CVE-2026-62071 is a critical (CVSS 9.3) unauthenticated SQL injection in the WordPress File Upload (wp-file-upload / Iptanus) plugin affecting versions ≤ 5.1.10 and fixed in 5.2.0; the flaw allows remote attackers to query and modify the WordPress database (including wp_users and wp_usermeta), potentially enabling credential theft, account takeover, and escalation to remote code execution on unpatched sites. Immediate actions: update to 5.2.0 or deactivate the plugin, rotate credentials, audit for suspicious accounts/files, and monitor logs/WAF signatures for exploitation attempts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.