CVE-2026-2354 is a high-severity vulnerability in the Swiss Toolkit For WP plugin for WordPress, caused by improper validation of uploaded file types in the upload_extension_files() function. The function hooks into WordPress's wp_check_filetype_and_ext filter but incorrectly uses strpos() to check if a filename contains an allowed extension substring rather than verifying the actual file extension. This flaw allows authenticated users with Author-level privileges or higher to bypass file type restrictions and upload arbitrary files, including PHP scripts. If the Enhanced Multi-Format Image Support feature is enabled with at least one allowed extension (e.g., avif), this can lead to remote code execution on the affected server. The vulnerability affects all versions up to and including 1.4.6. No patch or official fix has been disclosed as of the publication date.

An authenticated attacker with Author-level access or higher can upload arbitrary files, including executable PHP scripts, to the affected WordPress site. This can lead to full compromise of the server via remote code execution if the Enhanced Multi-Format Image Support feature is enabled with at least one allowed extension. The vulnerability compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling the Enhanced Multi-Format Image Support feature if enabled. Monitor for updates from the vendor regarding an official fix.