This vulnerability (CVE-2026-66447) involves improper neutralization of special elements used in an SQL command (CWE-89) in the nickboss WordPress File Upload plugin. Versions up to 5.1.7 are affected. The flaw allows unauthenticated attackers to perform SQL Injection attacks, which can compromise the confidentiality of the database. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. The impact includes high confidentiality loss and low availability impact. There is no vendor advisory or patch available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive database information due to SQL Injection. The vulnerability does not require authentication and can be exploited remotely, increasing risk. The integrity impact is not indicated, and availability impact is low. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting access to the affected plugin to mitigate risk.