CVE-2026-104028: CWE-434 Unrestricted Upload of File with Dangerous Type in Anton Extensions
Description
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
CVSS v3.1
Score 9.8critical
Affected software
Anton Extensions
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104028 is a vulnerability in the Anton Extensions WordPress plugin through version 1.2.2. The plugin fails to perform capability checks, nonce verification, or validate file types before writing uploaded files. This lack of validation allows unauthenticated attackers to upload arbitrary PHP files to paths of their choosing, resulting in remote code execution on the affected system.
Potential Impact
An attacker can achieve remote code execution on a vulnerable system by uploading malicious PHP files without authentication. This can lead to full compromise of the affected WordPress installation and potentially the underlying server.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Users should check the vendor advisory for updates and apply any official fixes once available. Until then, restricting file upload permissions and disabling the plugin may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-01T17:19:34.511Z
- State
- PUBLISHED
Threat ID: 6acb2ddc2cdf04f656b78cd9
Added to database: 10/11/2026, 06:34:04 UTC
Last enriched: 10/11/2026, 07:18:44 UTC
Last updated: 10/11/2026, 21:33:43 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.