What is the CVSS score of CVE-2026-14489?

CVE-2026-14489 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Wordpress Plugin are affected by CVE-2026-14489?

The WHMCS Bridge plugin for WordPress (versions through 6.9) contains an arbitrary file upload vulnerability (CVE-2026-14489) that enables authenticated users with Custom-level access or higher to…

How to fix or mitigate CVE-2026-14489?

Within 24 hours: Identify all WordPress instances running WHMCS Bridge plugin; audit which user accounts hold Custom-level privileges or above. Within 7 days: Disable or remove WHMCS Bridge plugin (all versions through 6.9) from affected installations if operationally feasible; if mission-critical, immediately restrict Custom-level access to only essential personnel and enable file upload monitoring. Within 30 days: Monitor WHMCS vendor advisory for patch availability; evaluate alternative bridge solutions without upload functionality gaps.

Wordpress Plugin CVE-2026-14489

EUVD-2026-42174 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-08 Wordfence

GHSA-mr5p-p2h6-gcmf

WordPress RCE File Upload Wordpress Plugin Whmcs Bridge

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 06:28 vuln.today

CVE Published

Jul 08, 2026 - 05:34 nvd

HIGH 8.8

DescriptionCVE.org

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

Arbitrary file upload in the WHMCS Bridge plugin for WordPress (all versions through 6.9) lets authenticated users with Custom-level access or above upload files of any type via the unvalidated connect() function, potentially achieving remote code execution on the host. Reported by Wordfence and tracked as CWE-434, the flaw carries a CVSS of 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The impact hinges on the plugin's failure to enforce file-type checks before writing uploaded content to disk.