## Summary
CVE-2026-66447 is an unauthenticated SQL injection affecting the WordPress plugin wp-file-upload in versions <= 5.1.7. The issue is rated critical (CVSS 9.3) and is described as likely to be used in mass-exploit campaigns.
## Technical Details
- Vulnerability type: SQL Injection (CWE-89).
- Exposure: Unauthenticated (no privileges required; PR:N, UI:N).
- Attack vector: NETWORK.
- Risk: An attacker may be able to directly interact with the database, including stealing information.
- Operational guidance from Patchstack: a mitigation rule can be enabled to block attacks until the plugin is updated.
## Affected
- WordPress plugin: wp-file-upload
- Affected versions: <= 5.1.7
## Impact
- Confidentiality impact: High (CVSS C:H) via potential database interaction and information theft.
- Integrity impact: none indicated in the provided material (I:N).
- Availability impact: limited/none indicated in the provided material (A:L).
## Mitigation
1. Update wp-file-upload to 5.1.8 or later.
2. If immediate updating is not possible, enable Patchstack’s mitigation rule to block attacks until the patched version is deployed.
3. If you cannot update yourself, request assistance from your hosting provider or web developer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CWE-89