CVE-2026-57628

Name of the Vulnerable Software and Affected Versions WP All Import versions prior to 4.0.2

Description The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with administrator-level access to perform SQL Injection. This enables the execution of additional SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 4.0.1.