THREAT OPS › Threat News › [NVD] CVE-2026-80488 (MEDIUM 4.1) — The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
[NVD] CVE-2026-80488 (MEDIUM 4.1) — The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
CVE-2026-80488 CVSS: 4.1 MEDIUM Published: 2026-08-29T06:17:49.663
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
Indicators of compromise
- CVE-2026-80488cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-80488