CVE-2026-118063criticalCWE-434

CVE-2026-118063: fallo crítico en Advance Guest Post

Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_action

Publicada el

Seguir esta CVE+ Monitorear Advance Guest Post

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

25Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8
The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · Advance Guest Post
CVEs relacionadas — Advance Guest Post

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-118065HIGHAdvance Guest Post <= 1.9 - Unauthenticated Arbitrary Attachment DeletionEPSS —CVE-2026-118064CRITICALAdvance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via featured_actionEPSS —