CVE-2026-17044 — WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid

CVE-2026-17044

WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid PUBLISHED

Description (CNA)

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.

Affected (CNA)

Vendor / product	Versions
Unknown / Iptanus File Upload	affected 0 before 5.1.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/364c99a4-4ce9-4e5f-bccc-2b4081e4031d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.