This vulnerability (CVE-2026-62071) is an improper neutralization of special elements used in an SQL command (CWE-89) in the nickboss WordPress File Upload plugin versions <= 5.1.10. It allows unauthenticated attackers to perform SQL Injection attacks, which can compromise the confidentiality of the database and cause partial denial of service. The CVSS v3.1 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation can lead to unauthorized disclosure of sensitive data (confidentiality impact is high) and partial disruption of service (availability impact is low). Integrity impact is not indicated. The vulnerability can be exploited remotely without authentication, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the vulnerable plugin functionality or disabling the plugin if feasible.