CVE-2026-6101 describes a vulnerability in the AMP for WP – Accelerated Mobile Pages plugin for WordPress, affecting versions up to and including 1.1.12. The issue is due to unsafe handling of ZIP file extraction combined with improper cleanup of nested directories and files in the ampforwp_save_local_font() function. This flaw allows authenticated attackers with Author-level access and Administrator-granted permissions to write arbitrary files to the server in a location accessible via the web. If the server executes PHP files from this location, it could lead to remote code execution. The CVSS 3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges with high attack complexity.

An attacker with Author-level access and Administrator permissions can write arbitrary files to a web-accessible directory on the server. This can lead to remote code execution if PHP files are executed from the uploads directory, compromising the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user permissions and review plugin usage. Monitor for updates from the vendor or plugin author for an official patch or mitigation instructions.