Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection via 'uniqueuploadid' Parameter
- ID
- WPSEC-2026-0302
- Plugin
- Iptanus File Upload (wp-file-upload)
- Affected
- all versions before 5.2.0
- Remediation
- Update to 5.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Iptanus File Upload on WPSec AttackSurface
- Fix released
- Published
Description
The Iptanus File Upload plugin for WordPress is vulnerable to SQL Injection via the 'uniqueuploadid' upload identifier in all versions up to, and including, 5.1.10. The value is only passed through sanitize_text_field(), which keeps single quotes, and is concatenated into SQL queries without preparation: when an upload is logged on forms with additional user data fields and, after the identifier has been stored, when the upload's user data is looked up, for example on the Uploaded Files and file browser admin pages. Version 5.1.8 parameterised only one of these queries (CVE-2026-17044). This makes it possible for unauthenticated attackers who can reach an upload form, which accepts guest uploads by default, to alter those queries. The identifier must be exactly 10 characters long, which limits exploitation to blind manipulation of the affected queries.
References
- https://wpsec.com/vuln/WPSEC-2026-0302/
- https://plugins.svn.wordpress.org/wp-file-upload/tags/5.2.0/
- https://wordpress.org/plugins/wp-file-upload/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS