CVE-2026-118063criticalCWE-434

CVE-2026-118063: falha crítica em Advance Guest Post

Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_action

Publicada em

Seguir esta CVE+ Monitorar Advance Guest Post

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

25Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8
The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Advance Guest Post
CVEs relacionadas — Advance Guest Post

No mesmo produto, das mais perigosas para as menos.

CVE-2026-118065HIGHAdvance Guest Post <= 1.9 - Unauthenticated Arbitrary Attachment DeletionEPSS —CVE-2026-118064CRITICALAdvance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via featured_actionEPSS —