CVE-2026-62071

{
  "etk_id": "ETK-2026-250",
  "cve_id": "CVE-2026-62071",
  "display_id": "CVE-2026-62071",
  "ghsa_id": "GHSA-84fg-9m65-7rf2",
  "euvd_id": "EUVD-2026-90852",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in WordPress File Upload",
  "summary": "WordPress File Upload plugin versions through 5.1.10 are affected by an SQL injection flaw. An unauthenticated attacker may be able to influence database queries on a site with the vulnerable plugin installed and reachable.",
  "mitigation": "Disable and remove the vulnerable WordPress File Upload plugin where possible until an updated release is available. Limit public access to sites using the plugin if it cannot be removed immediately.",
  "vendor": "nickboss",
  "product": "WordPress File Upload",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 5.1.10"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "wp-file-upload",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
  "epss_score": 0.0024,
  "epss_percentile": 0.1372,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 40.66758335,
  "t0_at": "2026-10-01T14:33:53.363000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-01T16:26:44.849308+00:00",
      "days": 0.07837368412037037,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T14:33:53.363000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-01T14:33:53.363000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T14:33:53.363000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62071"
    }
  }
}