Anton Extensions CVE-2026-104028

No special conditions beyond having the Anton Extensions plugin (version ≤1.2.2) installed and active on a reachable WordPress site - remote unauthenticated exploitation requires no account, nonce, or user interaction against default configurations. The exploit targets an upload handler that performs no capability check, no nonce verification, and no file-type validation, so any attacker who can reach the endpoint can write an arbitrary PHP file to an arbitrary path. The primary limiting factor is simply the plugin's presence and active status; there is no privilege, interaction, or non-default-setting requirement that would otherwise constrain exploitation.

All available signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no privileges or user interaction, and the triple-High impact (C:H/I:H/A:H) yielding 9.8 is consistent with the described outcome: unauthenticated arbitrary PHP upload leading to remote code execution (CWE-434). The description reinforces rather than contradicts the vector - absence of capability checks, nonce verification, and file-type validation genuinely means no authentication barrier, so PR:N is credible. POC status is 'Publicly available' (sourced from WPScan), which raises the practical likelihood of opportunistic attacks against exposed sites, but this is public exploit code, NOT confirmed active exploitation. No EPSS score was supplied, no CISA KEV listing is present, and no SSVC decision data was provided, so automatability and exploitation-in-the-wild cannot be asserted. The main tempering factor is deployment footprint: the affected product (Anton Extensions) appears to be an obscure, low-prevalence WordPress plugin with an 'unknown' CPE vendor, so this is more likely a targeted/opportunistic risk for the specific sites running it than a widespread internet-scale event.

An unauthenticated attacker locates a WordPress site running the Anton Extensions plugin (≤1.2.2) and sends a crafted HTTP request to the vulnerable upload handler, supplying a PHP webshell and an attacker-chosen destination path. Because no capability, nonce, or file-type checks are performed, the file is written to the web root and the attacker requests it to execute arbitrary code as the web server user. Public exploit code exists (per WPScan), lowering the skill needed to reproduce the attack.