The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (`wp-content/plugins/cmp-premium-themes/`), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0.
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers to sniff and render active content. An authenticated user can upload an HTML or SVG file containing JavaScript as a note asset, and when a victim navigates to the asset URL, the script executes under the application's origin with access to the victim's authenticated session and API actions. This issue has been fixed in version 0.19.2.
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
The Owen WebStack WordPress theme contains a critical vulnerability (CVE-2026-1555) due to missing file type validation in the io_img_upload() function. This flaw allows unauthenticated attackers to upload arbitrary files to the affected server, potentially enabling remote code execution. The vulnerability affects all versions up to and including 1.2024. No official patch or remediation guidance has been provided yet. The CVSS score is 9.8, indicating a critical severity level.
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. This vulnerability is fixed in 1.11.38.
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
The Gerador de Certificados – DevApps WordPress plugin up to version 1.3.6 contains a vulnerability that allows authenticated administrators to upload arbitrary files due to missing file type validation. This flaw exists in the moveUploadedFile() function and may enable remote code execution on the affected server. The vulnerability is tracked as CVE-2026-4808 and is rated with a high severity score of 7.2. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The DSGVO Google Web Fonts GDPR WordPress plugin (versions up to 1.1) contains an arbitrary file upload vulnerability due to missing file type validation in a function exposed via an unauthenticated AJAX hook. This allows attackers to upload malicious files, including PHP webshells, potentially leading to remote code execution. Exploitation requires the site to be using one of several specific WordPress themes. No official patch or remediation guidance is currently available.
A critical path traversal vulnerability (CWE-22) exists in ChurchCRM versions prior to 6.5.3 within the backup restore functionality. Authenticated administrators can exploit this flaw by uploading files with arbitrary names, enabling overwriting of Apache . htaccess files and potentially achieving remote code execution. The issue is due to improper validation of the filename parameter in RestoreJob.php. This vulnerability has a CVSS score of 9.1 and is fixed in version 6.5.
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
CVE-2026-35174 is a critical path traversal vulnerability in the Chyrp Lite blogging engine prior to version 2026.01. It allows an administrator or a user with Change Settings permission to manipulate the uploads path to arbitrary directories. This enables unauthorized downloading of sensitive files such as configuration files containing database credentials and overwriting critical system files, potentially leading to remote code execution. The vulnerability is fixed in version 2026.01.
Brave CMS versions prior to 2.0.6 contain an unrestricted file upload vulnerability in the CKEditor upload functionality. The vulnerability exists because the ckupload method does not properly validate file types, allowing authenticated users to upload executable PHP scripts. This can lead to remote code execution on the affected system. The vulnerability is tracked as CVE-2026-35164 and has a high severity rating with a CVSS score of 8.8. A fix for this issue was introduced in version 2.0.6.
Brave CMS versions prior to 2.0.6 contain an unrestricted file upload vulnerability in the CKEditor endpoint. This flaw allows attackers to upload arbitrary files, including executable scripts, which can lead to remote code execution on the server. Successful exploitation may result in full system compromise, data exfiltration, or service disruption. The vulnerability is identified as CWE-434 and has a critical severity with a CVSS score of 9.3. A fix for this issue is available in Brave CMS version 2.0.6.
The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_handle_dropped_media" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This makes it possible for unauthenticated attackers to upload arbitrary media to the site's media library, without achieving direct code execution.
CVE-2026-34735 is a high-severity vulnerability in HytaleModding wiki versions 1.2.0 and earlier. The quickUpload() endpoint improperly validates uploaded files by checking MIME type independently from the client-supplied file extension. This allows an attacker to upload files with dangerous extensions like . php that pass MIME type checks but can be executed on the server, leading to server-side code execution. No patches or official fixes are currently available for this issue.
CVE-2026-2701 is a critical vulnerability in Progress ShareFile Storage Zones Controller that allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution. The vulnerability arises from unrestricted upload of files with dangerous types. It has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided. The vulnerability affects the product version indicated as '0', with no known exploits in the wild at this time.