WordPress Plugin Vulnerabilities

WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.

Proof of Concept

Affects Plugins

Plugin icon
wp-file-upload
Fixed in 5.1.8

References

CVE
CVE-2026-17044

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
364c99a4-4ce9-4e5f-bccc-2b4081e4031d

Timeline

Publicly Published
2026-08-03 (about 27 days ago)
Added
2026-08-03 (about 26 days ago)
Last Updated
2026-08-27 (about 2 days ago)

Other

Published
Title
Published
2015-08-21
Title
Gallery Bank < 3.0.330 - Authenticated Blind SQL Injection
Published
2026-07-22
Title
AI Copilot < 1.5.8 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter
Published
2024-08-28
Title
Spiffy Calendar < 4.9.13 - Authenticated (Admin+) SQL Injection
Published
2025-03-27
Title
MC Woocommerce Wishlist < 1.9.0 - Authenticated (Administrator+) SQL Injection
Published
2022-02-28
Title
BookingPress < 1.0.11 - Unauthenticated SQL Injection