CVE-2026-104028
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation befor
CVSS
9.8
Crítica
EPSS
0.6%
p46
KEV
—
Exploit Today
14
0-100
Publicado: 11 de out. de 2026 · Última mod.: 13 de out. de 2026 · CWE-434
0.2%EPSS · 30 dias0.6%
2026-10-112026-11-05
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-928958.1 ALT—
———The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page.8hCVE-2026-11842310.0 CRÍ—
———The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.8hCVE-2026-1220477.3 ALT22.2%
——7A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.2dCVE-2026-1221209.0 CRÍ43.9%
——13In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.1dCVE-2026-1152436.7 MÉD23.9%
——7The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.2dCVE-2026-1217335.4 MÉD7.8%
——2Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.2d