PULSEUnderground Intel

EN VIVO43señales / 24h

FEED

ransombraincipher reclama a fbc.ca · CA · Financial Servicesransombraincipher reclama a hamiltonhealthcenter.com · CA · Healthcareransomplay reclama a Aripack · AR · Manufacturingransomplay reclama a StrucSure Home Warranty · US · Financial Servicesransomplay reclama a Standard Sand & Silica · US · Manufacturingransomplay reclama a Misura · CA · Technologyransomplay reclama a AVIR · Technologyransomwhitearmor reclama a Unilever · GB · Manufacturingransomsilentransomgroup reclama a W... G...ransomdark project reclama a Homestead Creamery · US · Agriculture and Food Productionransomdark project reclama a Food Bank of Central Louisiana · US · Agriculture and Food Productionransomdark project reclama a Simplehuman · US · Retail & E-Commerceransombraincipher reclama a hhjcpa.com · US · Professional Servicesransombraincipher reclama a prairieridge.net · US · Agriculture and Food Productionransombraincipher reclama a fbc.ca · CA · Financial Servicesransombraincipher reclama a hamiltonhealthcenter.com · CA · Healthcareransomplay reclama a Aripack · AR · Manufacturingransomplay reclama a StrucSure Home Warranty · US · Financial Servicesransomplay reclama a Standard Sand & Silica · US · Manufacturingransomplay reclama a Misura · CA · Technologyransomplay reclama a AVIR · Technologyransomwhitearmor reclama a Unilever · GB · Manufacturingransomsilentransomgroup reclama a W... G...ransomdark project reclama a Homestead Creamery · US · Agriculture and Food Productionransomdark project reclama a Food Bank of Central Louisiana · US · Agriculture and Food Productionransomdark project reclama a Simplehuman · US · Retail & E-Commerceransombraincipher reclama a hhjcpa.com · US · Professional Servicesransombraincipher reclama a prairieridge.net · US · Agriculture and Food Production

← Todos los CVEs

CVE Watch4 nov 2026

CVE-2026-115243

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores whe

CVSS

6.7

Medio

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 4 nov 2026 · Última mod.: 4 nov 2026 · CWE-434

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.

Referencias oficiales

wpscan.comhttps://wpscan.com/vulnerability/07de0f63-657d-4f97-b665-468e2dff7776/

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1220477.3 ALT

———A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.3h CVE-2026-1221209.0 CRÍ

———In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.7h CVE-2026-1217335.4 MED

——0Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.7h CVE-2026-733287.2 ALT

——0Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.1d CVE-2026-761248.8 ALT

——0The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.2d CVE-2026-1205349.8 CRÍ

——7The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.1d