The Improve SEO WordPress plugin versions up to and including 2.0.11 contains a vulnerability that allows unauthenticated users to upload executable PHP files due to improper validation of uploaded files. The plugin only checks the file content type but writes files with attacker-supplied extensions into a publicly accessible directory, enabling remote code execution.
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
A critical vulnerability (CVE-2026-16060) exists in the Insert or Embed Articulate Content into WordPress plugin up to version 4.3.0.0027. The plugin fails to properly validate uploaded archive contents, allowing an Editor-level user to upload server-executable files to a public directory. This can lead to remote code execution on servers configured to execute such files.
The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.
The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.
This issue affects FM Systems Employee: before 2025.3.1.
CVE-2026-16236 is a high-severity vulnerability in the Realtyna Organic IDX plugin for WordPress, affecting versions up to and including 5.3.0. It allows authenticated users with subscriber-level access or higher to upload arbitrary files due to missing file extension and content validation, combined with insufficient authorization and authentication checks in certain plugin functions and endpoints. This arbitrary file upload could lead to remote code execution on the affected server.
The Realtyna Organic IDX plugin and WPL Real Estate plugin for WordPress contain a critical vulnerability allowing unauthenticated attackers to upload arbitrary files, including potentially executable ones, due to missing file type validation and static default API credentials. This vulnerability affects all versions up to and including 5.2.0. Exploitation could lead to remote code execution. No official patch or remediation guidance is currently available.
CVE-2026-44103 is a vulnerability in Phoenix Contact CHARX SEC-3150 devices where the JupiCore service allows unauthenticated remote attackers to upload malicious firmware without integrity or verification checks. This can compromise the device's integrity. The issue affects versions from 1.0.0 up to but not including 1.9.1 and is fixed in version 1.9.1.
CVE-2026-44097 is a vulnerability in Phoenix Contact CHARX SEC-3150 that allows a low-privileged remote attacker with operator access to upload arbitrary files via the REST endpoint used for firmware updates. This can lead to persistent storage of attacker-controlled files and may exhaust device resources, potentially causing a denial-of-service condition.
The Admin and Site Enhancements (ASE) Pro WordPress plugin up to version 8.9.0 contains a critical vulnerability allowing unauthenticated remote code execution. This occurs via the recursive_html function, where attacker-controlled input is unsafely evaluated. The vulnerability requires the [post_cf_form] shortcode on a public page to expose a nonce and session ID to unauthenticated users, enabling exploitation without authentication or CAPTCHA validation.
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.