CVE-2026-75799criticalCWE-94

CVE-2026-75799: critical vulnerability in YAHMAN Add-ons

YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

Published

Follow this CVE+ Monitor YAHMAN Add-ons

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9epss 0.3%
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Unknown · YAHMAN Add-ons
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.