This vulnerability (CVE-2026-66447) is an unauthenticated SQL Injection in the nickboss WordPress File Upload plugin, affecting versions up to 5.1.7. The flaw involves improper neutralization of special elements used in SQL commands (CWE-89), allowing attackers to execute arbitrary SQL queries without authentication. The CVSS 3.1 score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. The impact includes high confidentiality loss and low availability impact. There is no vendor advisory or patch available at this time.

An unauthenticated attacker can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected plugin to mitigate risk.