CVE-2026-17044: Iptanus File Upload SQLi Vulnerability

CVE-2026-17044 Overview

CVE-2026-17044 is an unauthenticated SQL injection vulnerability affecting the Iptanus File Upload WordPress plugin in versions prior to 5.1.8. The plugin fails to sanitise and escape a user-supplied parameter before including it in a SQL statement. Attackers can inject arbitrary SQL over the network without authentication or user interaction. The issue is tracked under CWE-89 and carries a CVSS 3.1 base score of 8.6. Confidentiality impact extends beyond the vulnerable component through a changed scope, allowing extraction of database contents including WordPress credentials and session tokens.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, secrets, and sensitive site data.

Affected Products

Iptanus File Upload WordPress plugin versions prior to 5.1.8
WordPress sites with the Iptanus File Upload plugin active
Any hosting environment running the vulnerable plugin version

Discovery Timeline

2026-08-09 - CVE-2026-17044 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17044

Vulnerability Analysis

The Iptanus File Upload plugin exposes an endpoint that accepts a parameter later concatenated into a SQL query. The plugin does not apply WordPress escaping helpers such as esc_sql() or use prepared statements via $wpdb->prepare(). As a result, attacker-controlled input is interpreted as SQL syntax rather than data.

Because the vulnerable code path is reachable without authentication, any remote actor can send crafted HTTP requests to a vulnerable site. Successful exploitation permits the attacker to extract data from the WordPress database using UNION-based or time-based blind injection techniques. This includes the wp_users table, password hashes, and session tokens stored in wp_usermeta.

The CVSS vector indicates a scope change, reflecting that a compromised database query can affect resources beyond the plugin itself, including the broader WordPress installation.

Root Cause

The root cause is missing input sanitisation on a request parameter prior to its use in a SQL statement [CWE-89]. Developer code inserts raw input directly into a query string rather than using parameterised queries provided by the WordPress $wpdb abstraction.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an HTTP request containing SQL metacharacters in the affected parameter. The plugin passes the payload to the database engine, which executes the injected clauses. Refer to the WPScan Vulnerability Report for parameter-specific details.

No verified proof-of-concept exploit code has been published. The vulnerability mechanism follows standard SQL injection patterns applied to a WordPress AJAX or REST endpoint exposed by the plugin.

Detection Methods for CVE-2026-17044

Indicators of Compromise

HTTP requests to Iptanus File Upload plugin endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, --, or /*
Unusual outbound traffic from the web server following inbound requests to the plugin
Unexpected new administrator accounts or modifications to the wp_users table
Web server access logs showing repeated parameter fuzzing against plugin URLs

Detection Strategies

Review WordPress access logs for requests targeting Iptanus File Upload plugin paths with encoded SQL syntax in query strings or POST bodies
Enable WordPress database query logging to identify anomalous SELECT statements referencing sensitive tables
Deploy web application firewall rules that flag SQL injection signatures against /wp-admin/admin-ajax.php and plugin-specific routes

Monitoring Recommendations

Alert on repeated 500-series responses from plugin endpoints, which often indicate injection probing
Monitor for changes to WordPress user tables and privilege escalations from non-administrative sources
Track outbound connections from the web application to detect data exfiltration attempts

How to Mitigate CVE-2026-17044

Immediate Actions Required

Update the Iptanus File Upload plugin to version 5.1.8 or later on all WordPress installations
Rotate WordPress administrator passwords, API keys, and secrets stored in the database if compromise is suspected
Audit the wp_users table for unauthorised accounts and remove any not created by legitimate administrators

Patch Information

The vendor has released version 5.1.8 of the Iptanus File Upload plugin, which addresses the SQL injection by adding proper input sanitisation. Site administrators should apply the update through the WordPress plugin dashboard or by uploading the fixed release. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the Iptanus File Upload plugin until the update to 5.1.8 can be applied
Restrict access to plugin endpoints using web server rules or a web application firewall until patched
Enforce IP allowlisting on WordPress administration and upload endpoints where feasible

bash

# Example WP-CLI command to update the plugin
wp plugin update wordpress-file-upload --version=5.1.8