The Iptanus File Upload WordPress plugin contains an unauthenticated SQL injection vulnerability that arises because the uniqueuploadid parameter is not properly sanitized before being incorporated into an SQL statement. This flaw allows an attacker to supply crafted input that can execute arbitrary SQL queries on the backend database. If successful, the attacker can read sensitive data, modify or delete database contents, and undermine the confidentiality, integrity, and availability of the website. The weakness corresponds to the well‑known issue of SQL injection (CWE-89).

WordPress sites running the Iptanus File Upload plugin with a version older than 5.1.8 are vulnerable. The plugin is listed as 'Unknown:Iptanus File Upload' in the CNA data, indicating that the exact vendor is not specified, but the product name and affected version range are clear.

The plugin allows unauthenticated users to trigger the vulnerability, so any visitor to the site can potentially exploit it. The CVSS score is not provided, but the nature of the flaw and lack of authentication requirement suggest a high risk of exploitation. The EPSS score is not available and the vulnerability is not currently listed in CISA's KEV catalog. Attackers can craft a malicious uniqueuploadid value in a request to the plugin endpoint and inject SQL commands. If the website uses common WordPress database prefixes or default credentials, the likelihood of significant impact is high.