CVE-2026-45440: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Smackcoders Inc. WP Ultimate CSV Importer

This vulnerability (CVE-2026-45440) is an administrator-level SQL Injection in WP Ultimate CSV Importer versions up to 9.2. It arises from improper neutralization of special elements used in SQL commands (CWE-89). The CVSS 3.1 score is 7.6, indicating high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No vendor advisory or patch information is currently available.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries within the application.