Teddy Bear Customize Addon CVE-2026-14560

Requires only that the target WordPress site has the Teddy Bear Customize Addon plugin (version ≤1.0.5) installed and active, with its upload endpoint reachable over HTTP. No authentication, no user interaction, and no non-default configuration are needed - exploitation works against default installs. The practical limiting factor is deployment scope: the plugin is niche, so the affected population is small even though each affected site is trivially exploitable. Exploitation additionally assumes the server executes PHP from the upload directory (WordPress/Apache/nginx default unless hardened), so hosts that already block PHP execution in wp-content/uploads reduce impact to file drop without code execution.

This is a genuine high-priority issue, not a paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction - the easiest class to weaponize and automate - and the impact is full server compromise (C:H/I:H/A:H). Public exploit details exist (WPScan), lowering the bar for opportunistic mass-scanning of WordPress sites, which is typical for unauthenticated upload-to-RCE plugin bugs. Two signals temper the raw 10.0 score: the S:C (scope change) that pushes it to a perfect 10 is questionable - typical web-application RCE stays within the vulnerable component's authorization scope (S:U), which would yield 9.8, still Critical. No EPSS value and no KEV listing are provided, so widespread active exploitation is not confirmed; the presence of a POC is a distinct, lower signal than in-the-wild use. Any operator running this plugin - from a large hosting fleet down to a small municipal or hobby WordPress deployment - should treat this as urgent and patch or remove the plugin immediately given the trivial exploitability.

An attacker scanning for WordPress sites running the plugin sends a single crafted multipart POST to the plugin's upload endpoint, declaring an image Content-Type while the body is a PHP webshell named e.g. shell.php. The server accepts it based on the spoofed content type and stores it under its original name in a web-accessible directory; the attacker then requests the file over HTTP to execute arbitrary code. Public exploit details from WPScan make this reproducible with minimal effort and no authentication.