CVE-2026-57628: WP All Import SQL Injection Vulnerability

CVE-2026-57628 Overview

CVE-2026-57628 is a SQL injection vulnerability in the WordPress plugin WP All Import, affecting versions up to and including 4.0.1. The flaw allows an authenticated user with administrator privileges to inject malicious SQL statements into database queries processed by the plugin. Successful exploitation can lead to unauthorized access to database contents, modification of stored data, and limited impact on site availability. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command and was published to the National Vulnerability Database (NVD) on June 26, 2026.

Critical Impact
An authenticated administrator can execute arbitrary SQL queries against the WordPress database, exposing sensitive data across the site and any connected multisite instances.

Affected Products

WP All Import plugin for WordPress, versions <= 4.0.1
WordPress installations running the vulnerable plugin
Multisite WordPress deployments where the plugin is network-activated

Discovery Timeline

2026-06-26 - CVE-2026-57628 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57628

Vulnerability Analysis

WP All Import is a WordPress plugin used to import content from XML and CSV files into WordPress posts, pages, and custom post types. The plugin processes user-supplied input during import operations and passes portions of that input into SQL queries. In versions <= 4.0.1, at least one query path fails to properly sanitize or parameterize administrator-supplied values before concatenating them into a SQL statement.

Because the vulnerable code path requires administrator-level privileges, the attacker must already hold high-privilege access to the WordPress site. However, the scope changes because injected SQL executes with the database user configured for WordPress, which typically has full read and write access to every table in the database. This includes user credentials, session tokens, API keys stored in options tables, and content across all sites in a multisite network.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-89]. The plugin builds SQL queries by concatenating administrator-controlled input rather than using WordPress prepared statement helpers such as $wpdb->prepare(). Any single quote, comment sequence, or UNION clause supplied in the vulnerable parameter is interpreted as SQL syntax rather than as a literal value.

Attack Vector

An attacker who has obtained administrator credentials, whether through phishing, credential reuse, or compromise of a lower-privilege account chained with a privilege escalation flaw, submits a crafted import request or plugin configuration value containing SQL syntax. The plugin processes the request over HTTP, and the injected SQL executes against the WordPress database. Because the attack vector is Network and no user interaction is required beyond the attacker's own actions, exploitation can be fully automated once credentials are available.

See the Patchstack advisory for WP All Import for additional technical context.

Detection Methods for CVE-2026-57628

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, SLEEP(, or information_schema in web server access logs targeting WP All Import endpoints under /wp-admin/admin.php?page=pmxi-admin-*.
Administrator sessions performing import operations from unfamiliar IP addresses or at unusual times.
New or modified rows in the wp_users and wp_usermeta tables that do not correspond to legitimate account changes.
Outbound database errors logged by MySQL or MariaDB referencing malformed queries originating from PHP request handlers in the plugin directory.

Detection Strategies

Enable WordPress debug logging (WP_DEBUG_LOG) and monitor wp-content/debug.log for SQL errors that reference WP All Import functions.
Deploy a web application firewall (WAF) rule set that inspects POST bodies to plugin administration pages for SQL metacharacters.
Correlate administrator authentication events with subsequent database query anomalies to identify credential misuse.

Monitoring Recommendations

Alert on any HTTP request to WP All Import admin pages containing URL-encoded SQL keywords such as %27, %20UNION%20, or --.
Monitor MySQL general query logs for statements originating from the WordPress database user that reference tables outside the plugin's normal scope, such as wp_users during import operations.
Track administrator account creation, role changes, and password resets in near real time.

How to Mitigate CVE-2026-57628

Immediate Actions Required

Update WP All Import to a version later than 4.0.1 as soon as the vendor publishes a fixed release referenced in the Patchstack advisory.
Audit all WordPress administrator accounts and remove any that are unused or unrecognized.
Rotate administrator passwords and enforce multi-factor authentication on every account with the administrator role.
Review database contents for unauthorized modifications, particularly in wp_users, wp_usermeta, and wp_options.

Patch Information

Refer to the Patchstack advisory for WP All Import for the fixed version and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release. Verify the installed version under Plugins > Installed Plugins after upgrading.

Workarounds

Deactivate WP All Import until the patched version is installed if imports are not required for site operation.
Restrict administrator access to trusted IP ranges using web server or WAF rules to reduce the window for credential abuse.
Apply the principle of least privilege by limiting the number of accounts holding the administrator role and using editor or lower roles where possible.

bash

# Configuration example: restrict wp-admin to specific IPs via .htaccess
<Files "admin.php">
    Require ip 203.0.113.10
    Require ip 198.51.100.0/24
</Files>