The Iptanus File Upload WordPress plugin before version 5.1.8 contains an SQL injection vulnerability (CWE-89) due to improper sanitization and escaping of a parameter used in a SQL statement. This flaw allows unauthenticated users to inject malicious SQL code, potentially compromising the confidentiality of the database. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to access or extract sensitive information from the database. The CVSS vector indicates confidentiality impact is high, while integrity and availability impacts are not affected. This could lead to data leakage or exposure of sensitive information stored by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin version to prevent exploitation.