The Iptanus File Upload WordPress plugin contains an unauthenticated SQL injection vulnerability that arises because the uniqueuploadid parameter is not properly sanitized before being incorporated into an SQL statement. This flaw allows an attacker to supply crafted input that can execute arbitrary SQL queries on the backend database. If successful, the attacker can read sensitive data, modify or delete database contents, and undermine the confidentiality, integrity, and availability of the website.

WordPress sites running the Iptanus File Upload plugin with a version older than 5.1.8 are vulnerable. The plugin is listed as 'Unknown:Iptanus File Upload' in the CNA data, indicating that the exact vendor is not specified, but the product name and affected version range are clear.

The plugin allows unauthenticated users to trigger the vulnerability, so any visitor to the site can potentially exploit it. The CVSS score of 8.6 signals a high severity, while the EPSS score is less than 1%. The vulnerability is not listed in CISA's KEV catalog. Attackers can craft a malicious uniqueuploadid value in a request to the plugin endpoint and inject SQL commands, potentially gaining full control over the site database.