CVE-2026-12872 is a vulnerability in the Webinfos WordPress plugin through version 1.2 where the plugin does not validate the type or name of uploaded files and lacks authentication, capability, or nonce checks on the upload action. This allows unauthenticated attackers to upload arbitrary files, including executable PHP scripts, to a web-accessible directory. If the server executes PHP files from this directory, attackers can achieve remote code execution.

An attacker can upload malicious files without authentication, potentially leading to remote code execution on affected servers. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability poses a significant risk as it allows full server compromise if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable file uploads in the Webinfos plugin, implement web server rules to prevent execution of uploaded files, and monitor for suspicious activity related to file uploads.