CVE-2026-80488: CWE-89 SQL Injection in WP Ultimate CSV Importer

The WP Ultimate CSV Importer plugin for WordPress, prior to version 9.0, fails to properly sanitize and escape imported field values before incorporating them into SQL statements. This vulnerability (CWE-89) enables users with high privileges, such as admins, to conduct SQL injection attacks, potentially compromising data confidentiality. The CVSS v3.1 base score is 4.1, reflecting a network attack vector with low complexity, requiring high privileges but no user interaction, and resulting in limited confidentiality impact without integrity or availability effects. No patch or official remediation has been confirmed as of the publication date.

An attacker with high privileges (e.g., an administrator) can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized disclosure of data within the database. The impact is limited to confidentiality with no direct integrity or availability impact reported. Since exploitation requires high privileges, the risk is contained to trusted users with administrative access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and avoid importing untrusted CSV data. Monitor vendor channels for updates regarding patches or official mitigations.