CVE-2026-66447

Executive Summary

CVE-2026-66447 is a critical unauthenticated SQL Injection vulnerability affecting the WordPress File Upload plugin, version 5.1.7 and earlier. The flaw allows any unauthenticated remote attacker to inject arbitrary SQL queries through vulnerable plugin parameters, potentially leading to full database compromise including exfiltration of usernames, password hashes, and sensitive application data. The vulnerability is actively targeted due to its critical severity (CVSS 9.3), the popularity of the WordPress platform, and the ease of exploitation with no authentication requirements.

Technical Analysis

The WordPress File Upload plugin is a widely adopted WordPress extension used to manage file submissions and uploads on WordPress-powered websites. The vulnerability exists within the plugin's database interaction layer, where user-supplied input is concatenated into SQL queries without adequate sanitization or parameterized prepared statements. This flaw falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection.

The NVD description specifically identifies that the vulnerability affects all versions up to and including 5.1.7 and states that it can be exploited without authentication. The plugin's frontend components expose parameters that process file uploads and associated metadata. When an attacker submits crafted HTTP requests to endpoints that handle upload functionality, the plugin fails to neutralize SQL metacharacters (quotes, semicolons, UNION keywords) in specific parameters before embedding them into SQL queries.

The vulnerability class is particularly dangerous in WordPress plugins because the underlying database typically contains critical WordPress data: user accounts with hashed credentials, configuration secrets, active plugins/themes, and potentially sensitive business data processed by the site. Although the CVSS vector indicates High confidentiality impact and only Low availability impact (no integrity impact directly), the confidentiality breach is severe because it exposes the entire database contents.

The attack vector is network-based (AV:N), requires low attack complexity (AC:L), demands no privileges (PR:N), and does not require user interaction (UI:N). The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the underlying database server.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification: An attacker begins by identifying WordPress sites running the File Upload plugin. Using search engines with dorks such as inurl:/wp-content/plugins/wp-file-upload/ or Shodan queries, the attacker identifies candidate targets. Version enumeration is performed by reviewing the readme.txt file accessible via /wp-content/plugins/wp-file-upload/readme.txt or by examining page source for version annotations.

Step 2 — Request Crafting and Parameter Identification: The attacker targets plugin endpoints that handle upload-related database operations. These endpoints process user-supplied parameters such as file descriptors, session tokens, upload metadata, or form field identifiers. The attacker submits HTTP requests targeting these endpoints, modifying the vulnerable parameters.

Step 3 — SQL Injection Payload Execution: The attacker injects SQL payloads into the vulnerable parameter value. A simple detection query may use a single quote followed by a technique designed to determine if the parameter breaks out of the SQL string context. To extract data, the attacker uses UNION-based injection: for example, injecting ' UNION SELECT user_login, user_pass FROM wp_users-- to retrieve username and password hashes. Alternatively, error-based or boolean-based blind injection may be used if the plugin suppresses direct output.

Step 4 — Data Exfiltration: The attacker enumerates database tables, determines column structures, and extracts authentication data. WordPress password hashes are PHPass or bcrypt-based, but offline cracking may be feasible for weak passwords. The attacker may also extract:

• wp_users table: usernames, email addresses, password hashes
• wp_options table: site configuration, API keys, plugin secrets
• wp_posts/wp_postmeta: uploaded file metadata or business content

Step 5 — Post-Exploitation Impact: With hashed credentials, the attacker either cracks weak passwords or combines database dumps with password spraying attempts. In the worst case, if the database user has elevated privileges, the attacker may write files to the server or manipulate the WordPress installation to achieve full site compromise.

The exploitation requires only an HTTP request to the target site; no authentication or prior access is needed, making this vulnerability remotely exploitable from any network position.

Impact Assessment

The CVSS score of 9.3 is critical, reflecting the combination of network exploitability, no authentication requirement, low attack complexity, and the high confidentiality impact. The scope change (S:C) indicates the vulnerability extends beyond the plugin to the database server and potentially the entire hosting environment if database permissions are misconfigured.

Business Impact: WordPress sites processing sensitive user data (e-commerce transactions, personal information, membership data) face direct regulatory exposure under GDPR, HIPAA, or PCI DSS. The complete database dump exposes personally identifiable information, financial records, and authentication credentials.

Affected Systems: Any WordPress installation with the WordPress File Upload plugin version 5.1.7 or earlier. The plugin is commonly deployed on business websites for customer support file submissions, contract uploads, hiring portals, and photo galleries. Specialized installations for government or enterprise file intake share the same exposure.

Blast Radius: The attack surface is the public-facing WordPress site. The impact extends to: the WordPress database, all plugin/theme configurations, potential lateral movement to the hosting server if the database user has FILE privileges, and downstream user accounts that may be compromised through credential reuse. The low availability impact (A:L) means attackers can craft payloads that cause database errors or outages, potentially disrupting site functionality.

Threat Landscape: SQL injection vulnerabilities in WordPress plugins are among the most aggressively exploited flaws due to the ubiquity of WordPress (over 40% of websites) and the proven effectiveness of automated exploitation toolkits like SQLmap. Previous WordPress SQL injection flaws have been exploited en masse using botnets scanning for vulnerable installations within hours of public disclosure.

Detection Guidance

Sigma Rule

title: WordPress File Upload Plugin SQL Injection Attempt
id: 3e5f72a1-8c24-4c8b-9d31-5f7d91842bc6
status: experimental
description: Detects SQL injection attempts targeting the WordPress File Upload plugin
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache|nginx|iis
detection:
  selection_base:
    cs-method: 'GET|POST'
    cs-uri-query|contains:
      - 'wp-file-upload'
      - 'wordpress_file_upload'
      - 'wfu_'
  selection_sqli:
    cs-uri-query|contains|all:
      - 'union'
      - 'select'
      - 'from'
  selection_sqli_simple:
    cs-uri-query|contains|any:
      - "'"
      - '%27'
      - '--'
      - ';'
      - 'or 1=1'
      - '%20or%20'
  condition: selection_base and (selection_sqli or selection_sqli_simple)
falsepositives:
  - Legitimate queries containing SQL keywords in filenames (rare)
level: high
fields:
  - clientip
  - cs-uri-query

YARA Rule

rule WordPress_File_Upload_SQLi_CVE_2026_66447 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads targeting WordPress File Upload plugin"
        cve = "CVE-2026-66447"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $p1 = "wp-file-upload" ascii nocase
        $p2 = "wordpress_file_upload" ascii nocase
        $p3 = "wfu_" ascii nocase
        $s1 = "union select" ascii nocase
        $s2 = "union all select" ascii nocase
        $s3 = "information_schema" ascii nocase
        $s4 = "wp_users" ascii nocase
        $s5 = "sleep(" ascii nocase
        $s6 = "extractvalue(" ascii nocase
        $s7 = "updatexml(" ascii nocase
        $s8 = "0x" ascii nocase
        $s9 = "--" ascii nocase
        $s10 = "/*" ascii nocase
    condition:
        any of ($p*) and (
            3 of ($s*) or
            (any of ($s*) and #s1 > 0)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-66447 WordPress File Upload SQL Injection Attempt"; flow:established,to_server; http.uri; content:"wp-file-upload"; nocase; http.uri; content:"union"; nocase; http.uri; content:"select"; nocase; distance:0; http.uri; content:"from"; nocase; distance:0; pcre:"/(?:union|select|sleep|extractvalue|updatexml|information_schema|wp_users)/i"; classtype:web-application-attack; sid:7004471; rev:1; reference:cve,2026-66447; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-66447;)

Elastic Detection

POST /_security/rule/10000127
{
  "description": "Detects SQL injection attempts against the WordPress File Upload plugin",
  "enabled": true,
  "language": "eql",
  "risk_score": 95,
  "name": "WordPress File Upload SQL Injection Detection",
  "query": "any where process.name == \"httpd\" or process.name == \"nginx\" or process.name == \"w3wp.exe\" and url.path contains \"wp-file-upload\" and (url.query contains \"union\" or url.query contains \"select\" or url.query contains \"information_schema\" or url.query contains \"wp_users\" or url.query contains \"%27\" or url.query contains \"--\" or url.query contains \"or+1=1\")",
  "severity": "critical",
  "type": "eql"
}

Splunk SPL Query

index=web sourcetype=apache:access OR sourcetype=nginx:access OR sourcetype=iis
| search uri_path="/wp-content/plugins/wp-file-upload/*" OR uri_query="*wp-file-upload*"
| regex uri_query="(?i)(union\s+select|information_schema|wp_users|extractvalue\(|updatexml\(|sleep\(|%27|--\s|or\s+1=1)"
| eval attack_type="SQL Injection - WordPress File Upload"
| eval cve_id="CVE-2026-66447"
| table _time, src_ip, host, uri_path, uri_query, response_bytes, method, attack_type, cve_id
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress, sql_injection, attack, cve_2026_66447,">
    <rule id="510471" level="14">
        <if_sid>31100, 31101, 31103</if_sid>
        <field name="url">wp-file-upload</field>
        <regex>(\bunion\b.*\bselect\b|\binformation_schema\b|\bwp_users\b|extractvalue\(|updatexml\(|sleep\()</regex>
        <description>CVE-2026-66447: Possible SQL injection attempt against WordPress File Upload plugin detected in access log.</description>
        <group>attack,sqli,wordpress,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence assessment: The vendor/CNA claims a fix is available; however, this is rated 2/4 confidence, meaning the patch existence is only confirmed by a single source and has not been independently verified or widely tested.

1. Immediate Mitigations (within 24 hours):

   • Block plugin endpoints at WAF level: If using a Web Application Firewall (WAF), immediately deploy temporary rules blocking requests to wp-file-upload URI paths that contain SQL metacharacters. Most WAF providers offer generic SQLi detection; ensure it is enabled for POST and GET requests to WordPress upload plugin paths.
   • Restrict database user privileges: If the WordPress database user has elevated privileges (FILE, PROCESS, SUPER), immediately restrict via database administrator. The WordPress DB user should only have SELECT, INSERT, UPDATE, DELETE on the WordPress database.
   • Enable query logging during triage: Temporarily enable MySQL/MariaDB general query log to capture any malicious queries hitting the database.

2. Patch/Upgrade Steps:

   • Primary action: Update the WordPress File Upload plugin to version 5.1.8 or greater. Log into the WordPress admin dashboard, navigate to Plugins → Installed Plugins, identify "WordPress File Upload," and select "Update Now" if a newer version is available.
   • If plugin auto-updates are not functioning, download the latest version from the WordPress.org plugin repository and replace the plugin files via FTP/SFTP.
   • After updating, clear the WordPress object cache (if using a caching plugin) to ensure the updated code is actively served.
   • Note: The vendor has claimed the fix but it is not independently confirmed. After updating to the latest version, manually test the upload functionality to ensure it works correctly and free of injection points.

3. Long-Term Hardening:

   • Implement a WAF: Deploy an enterprise WAF (Cloudflare, AWS WAF, Imperva, or equivalent) with SQL injection protection rules for the WordPress application. Configure custom rules to block high-risk requests.
   • Enable version controls: Implement a plugin version monitoring system (e.g., WPScan, Patchstack, Wordfence) to receive immediate notifications for future plugin advisories.
   • Database least privilege: Confirm the WordPress database user has the minimum required database privileges. Revoke FILE, SUPER, PROCESS, and GRANT OPTION.
   • Disable error reporting: Ensure PHP error display is disabled to prevent attackers from gaining query feedback useful for blind SQL injection. Set display_errors = Off in php.ini.
   • Connection encryption: Enforce TLS/SSL on all WordPress frontend endpoints to prevent HTTP request sniffing.
   • Regular backup strategy: Maintain automated, off-site backups of the WordPress database so a data breach or destructive attack can be recovered from.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66447
2. Patchstack Advisory (CNA source for vulnerability disclosure): https://patchstack.com/database/vulnerability/wordpress-file-upload
3. WordPress Plugin Directory — WordPress File Upload plugin: https://wordpress.org/plugins/wp-file-upload/
4. CWE-89 — SQL Injection: https://cwe.mitre.org/data/definitions/89.html
5. ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity Evidence: As of this report's writing, there is no documented public exploit code, no Nuclei template, and no known threat actor campaign specifically attributed to CVE-2026-66447. However, the vulnerability class (unauthenticated SQL injection in a WordPress plugin) is historically exploited rapidly once disclosed — often within 24-72 hours in WordPress botnet campaigns. The vulnerability is NOT on the CISA KEV (Known Exploited Vulnerabilities) catalog at the time of writing, but the critical CVSS score and ease of exploitation make it likely to be targeted. The EPSS score has not yet been assigned by FIRST.org. Monitor threat intelligence feeds and WordPress security advisories for updates.