The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress versions up to 2.7.7 is vulnerable to arbitrary file upload due to insufficient file type validation in the putFile function. Authenticated users with subscriber-level access or higher can upload potentially executable files. Server-side protections rely on a .htaccess file that is ineffective on nginx or Apache servers with AllowOverride None, enabling remote code execution in those environments.
The ELEX WordPress HelpDesk & Customer Ticketing System plugin versions up to and including 3.3.7 contain an arbitrary file upload vulnerability due to insufficient validation of IMAP email attachments. This flaw allows unauthenticated attackers to upload potentially executable files, enabling remote code execution. The vulnerability is identified as CWE-434 and has a critical CVSS score of 9.8.
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.
CVE-2026-105032 is a critical vulnerability in the EnergizeLab FastAPI AI inference server used by Eilik and EilikO robots. The AI skill upload endpoint lacks authentication and does not restrict file paths, allowing unauthenticated remote attackers to perform path traversal and write arbitrary files. This enables tampering with AI skill files, potentially impacting the integrity and availability of the AI services.
The 10Web Booster WordPress plugin up to version 2.34.10 contains an arbitrary file upload vulnerability due to missing file type validation and leaked authentication nonce. This allows unauthenticated attackers to upload potentially executable files, enabling remote code execution. The vulnerability arises from a world-readable REST nonce file generated during bulk optimization pauses, which bypasses authentication checks.
FileRise versions prior to 3.16.0 contain a vulnerability where archive extraction does not properly enforce upload filename restrictions before writing files to disk. An authenticated user with upload and extract permissions can upload a ZIP archive containing files with blocked extensions, such as PHP scripts, which are then extracted and saved despite normal upload restrictions. This can lead to unauthorized code execution if the deployment executes uploaded content. The issue is fixed in version 3.16.0.
The FV Flowplayer Video Player WordPress plugin up to version 7.5.54.7212 contains a vulnerability allowing limited arbitrary file upload due to insufficient file type validation in the check_mimetype function. Authenticated users with subscriber-level access or higher can upload potentially executable files if the 'profile videos on bio' option is enabled, enabling remote code execution. Exploitation requires this specific plugin setting to expose a nonce on subscriber-accessible profile pages.
The JTL-Connector for WooCommerce WordPress plugin is affected by a critical arbitrary file upload vulnerability in all versions up to and including 2.4.3. This flaw arises from improper authentication handling and insufficient file type validation, allowing unauthenticated attackers to upload potentially executable files. Successful exploitation could lead to remote code execution on the affected system.
The AGE-GATE WordPress plugin (versions up to and including 1.0) contains a critical remote code execution vulnerability due to an unauthenticated admin.php endpoint that lacks WordPress loading and security checks. This allows attackers to inject unsanitized POST parameters into PHP source code, enabling code execution on the server without authentication.
The Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) contains an arbitrary file upload vulnerability due to insufficient validation in the save-to-cache.php script. This script lacks WordPress bootstrap, authentication, capability, and nonce checks, allowing authenticated users with subscriber-level access or higher to upload executable PHP files. The vulnerability arises because the pluginURL parameter is only filtered with FILTER_SANITIZE_URL, which does not prevent PHP payload injection. Uploaded PHP code is written to cached-content/cached-feed.php and can be executed via a GET request, enabling remote code execution.
The Printcart Store plugin for WooCommerce (versions up to and including 2.9.1) contains an unauthenticated arbitrary file upload vulnerability. This flaw allows attackers to upload malicious PHP files via the nbdesigner_copy_image_from_url AJAX action, which is accessible without authentication. The vulnerability arises because the plugin improperly rebuilds the destination filename from attacker-controlled input, bypassing file type restrictions and enabling remote code execution. The exploit requires no user interaction or privileges, making it critical.
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
CVE-2026-62129 is a critical vulnerability in WPFunnels Creator LMS versions up to 1.2.21 that allows contributor-level users to upload arbitrary files without restriction on file type. This unrestricted file upload can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-62025 is a critical vulnerability in Tailored Media's Tailored Tools product, versions up to and including 3.0.3. It allows unauthenticated attackers to upload arbitrary files with dangerous types, potentially leading to complete system compromise. The vulnerability is characterized as CWE-434, indicating unrestricted file upload of dangerous types. No specific affected versions beyond <=3.0.3 are provided. There is no information about available patches or vendor advisories. The CVSS 3.1 base score is 9.0, reflecting high attack complexity and severe impact on confidentiality, integrity, and availability.
CVE-2026-62024 is a critical vulnerability in CodeBard Help Desk versions up to 1.1.2 that allows arbitrary file upload of dangerous file types. This unrestricted upload flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.