The WP Ultimate CSV Importer plugin for WordPress versions up to 7.37 suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in the 'file_name' parameter. This parameter is stored during file upload and later incorporated into raw SQL queries without adequate sanitization. The vulnerability requires authenticated access at Subscriber level or higher and is only exploitable when the 'Single Import/Export' feature is enabled on servers running PHP versions less than 8.0. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. The impact is unauthorized disclosure of sensitive data (confidentiality impact), with no integrity or availability impact reported. No known exploits in the wild have been reported. No patch or official remediation has been provided in the available data.

Successful exploitation allows an authenticated user with Subscriber-level privileges or higher to perform SQL Injection attacks by manipulating the 'file_name' parameter. This can result in unauthorized disclosure of sensitive information from the database. The vulnerability does not affect integrity or availability. Exploitation requires the 'Single Import/Export' option to be enabled and PHP version below 8.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the 'Single Import/Export' option or upgrading the PHP version to 8.0 or higher to mitigate the risk. Additionally, restrict file upload permissions to trusted users only and monitor for suspicious activity related to file uploads.