CVE-2026-84171criticalCWE-434

CVE-2026-84171: critical vulnerability in WP images upload on piclect

WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

Published

Follow this CVE+ Monitor WP images upload on piclect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 0.7%
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · WP images upload on piclect
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.