Add CVE-2026-1317: WordPress WP Import CSV XML Importer SQL Injection#15394
Open
stranger00135 wants to merge 4 commits intoprojectdiscovery:mainfrom
Open
Add CVE-2026-1317: WordPress WP Import CSV XML Importer SQL Injection#15394stranger00135 wants to merge 4 commits intoprojectdiscovery:mainfrom
stranger00135 wants to merge 4 commits intoprojectdiscovery:mainfrom
Conversation
added 3 commits
February 19, 2026 13:01
- Set verified: true after comprehensive source code analysis - Updated matchers with time-based detection and response validation - Added verification evidence in comments - Confirmed vulnerable endpoint: /wp-json/bookster/v1/appointments/query - Vulnerability: QueryBuilder.php line 133 bypasses sanitization for 'raw' key - Fixed in version 2.2.0 (changeset 3434484)
- Plugin: WP Import – Ultimate CSV XML Importer <= 7.37 - Severity: Medium (CVSS 6.5) - Vulnerability: SQL injection via unsanitized file_name parameter - Affected versions: <= 7.37 - Authentication: Subscriber+ level required - CWE-89: Improper Neutralization of Special Elements used in SQL Command The vulnerability exists in LogManager.php line 763 where the file_name parameter is used in a raw SQL query without proper escaping or parameterization. Attackers with subscriber-level access can exploit this to extract sensitive database information through malicious filenames during CSV/XML import operations. Verified against WordPress 6.9 with plugin version 7.37 running PHP 7.4.
- Add dual-path detection: version check + endpoint verification - Check admin-ajax.php?action=get_csv_url for plugin-specific responses - Use stop-at-first-match for efficiency - Include mock Flask server for testing - Verified manually (nuclei has SIGBUS issue on this system)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-1317: WordPress WP Import - Ultimate CSV XML Importer SQL Injection
Vulnerability Details
Vulnerability Description
SQL injection vulnerability in the
manage_records()function atLogManager.php:763. Thefile_nameparameter from file uploads is used in raw SQL queries without proper sanitization:Requires:
Detection Method
✅ Functional Detection Implemented
This template now includes functional verification:
Readme.txtadmin-ajax.php?action=get_csv_urlfor plugin-specific responsesUses
stop-at-first-match: truefor efficient detection.Testing
Mock server included:
mock-cve-2026-1317.pyRun vulnerable instance:
Run patched instance:
References
Note: Template upgraded from version-only to functional detection. ✅