The vulnerability CVE-2026-32523 in denishua WPJAM Basic allows an attacker with low privileges to upload files of dangerous types without restriction. This unrestricted file upload can be leveraged to execute malicious code or otherwise compromise the affected system. The issue affects all versions up to and including 6.9.2. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability allows attackers to upload malicious files that could be executed or used to escalate privileges, severely impacting the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious file uploads as a temporary measure. Avoid granting unnecessary privileges to users who can upload files.