CVE-2026-118065highCWE-862

CVE-2026-118065: fallo de gravedad alta en Advance Guest Post

Advance Guest Post <= 1.9 - Unauthenticated Arbitrary Attachment Deletion

Publicada el

Seguir esta CVE+ Monitorear Advance Guest Post

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

18Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5
The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Unknown · Advance Guest Post
CVEs relacionadas — Advance Guest Post

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-118064CRITICALAdvance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via featured_actionEPSS —CVE-2026-118063CRITICALAdvance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_actionEPSS —