Webinfos CVE-2026-12872

Exploitation requires that the target WordPress site has the Webinfos plugin (≤1.2) installed and active, and - critically - that the server executes PHP from the wp-content/uploads directory (the CVE explicitly scopes RCE to 'servers that execute PHP from the uploads path'). The upload action itself needs no authentication, capability, or nonce (AV:N/AC:L/PR:N/UI:N), so no credentials or user interaction limit it. The primary limiting factor is the PHP-in-uploads execution requirement: on hardened hosts that block PHP execution in uploads, the arbitrary file upload still succeeds but code execution may be prevented, downgrading impact to file write/storage abuse rather than immediate RCE.

The signals mostly align toward high real-world risk with one notable divergence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates trivial remote, unauthenticated, no-interaction exploitation with total confidentiality, integrity, and availability impact, and SSVC corroborates this with Automatable:yes and Technical Impact:total. Publicly available exploit code further lowers the barrier. The one conflicting signal is EPSS: 0.28% (20th percentile) is low, and SSVC Exploitation is 'none' (no confirmed in-the-wild activity), suggesting that despite the ease of exploitation, mass exploitation has not yet been observed - likely a function of the plugin's small install base rather than any technical difficulty. In short, this is a genuine high-priority issue for any site running Webinfos, but the low EPSS reflects limited prevalence, not limited exploitability. No KEV listing exists, so exploitation is not confirmed active.

An attacker discovers a WordPress site running Webinfos, then sends a single crafted HTTP POST to the plugin's unauthenticated upload action carrying a PHP webshell. Because no authentication, nonce, or file-type check applies and the file lands in a web-accessible uploads path that executes PHP, the attacker browses to the uploaded shell and runs arbitrary commands as the web-server user. Public exploit code from WPScan makes this reproducible with minimal effort.