What is the CVSS score of CVE-2026-16250?

CVE-2026-16250 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Personal QR Message are affected by CVE-2026-16250?

The Personal QR Message WordPress plugin (versions ≤1.0) contains a critical, unauthenticated remote code execution flaw that allows attackers to upload and execute arbitrary PHP files, resulting in…

Is there a public PoC exploit available for CVE-2026-16250?

Yes, a public proof-of-concept exploit is available for CVE-2026-16250. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16250?

Within 24 hours, immediately disable and remove the Personal QR Message WordPress plugin from all WordPress installations, then conduct forensic analysis of server logs, file systems, and web directory for signs of unauthorized file uploads or code execution. Within 7 days, perform a comprehensive security assessment of all affected systems to identify backdoors, compromised credentials, or lateral movement, and implement enhanced logging for file uploads and PHP execution in plugin directories. Within 30 days, identify and deploy a replacement QR code solution from a vendor with documented security practices, maintain subscription to security advisory feeds for this plugin's repository, and conduct a post-incident review of affected systems.

Personal QR Message CVE-2026-16250

EUVD-2026-52178 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-03 WPScan

GHSA-r4mq-7p9v-x8fv

PHP WordPress RCE File Upload Personal Qr Message Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable upload handler with no user interaction (AV:N/AC:L/PR:N/UI:N) yields arbitrary PHP execution, giving full C/I/A impact on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:23 vuln.today

CVSS changed

Aug 04, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

AnalysisAI

Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.

Technical ContextAI

The affected component is a WordPress plugin, meaning it runs inside a PHP web application typically served by Apache or nginx with PHP-FPM. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin exposes an upload handler that does not validate or restrict the extension/MIME type of submitted files, so an attacker can place a .php file inside the web root. Because WordPress serves files from writable upload directories (commonly wp-content/uploads) and the uploaded script is 'directly reachable,' the PHP interpreter executes it on request, converting an upload primitive into arbitrary code execution. The CPE cpe:2.3:a:unknown:personal_qr_message:*:*:*:*:*:*:*:* identifies the affected application, with the vendor listed as 'unknown' in the available data.

RemediationAI

No vendor-released patched version is identified in the available data - the vulnerability affects the plugin 'through 1.0' with no fixed release referenced, so No vendor-released patch identified at time of analysis. The most effective action is to deactivate and remove the Personal QR Message plugin entirely until a vendor fix is published, since the exposed unauthenticated upload handler cannot be trusted while present. If removal is not immediately possible, compensating controls include using a WAF or web server rules to block requests to the plugin's upload endpoint, and configuring the web server to deny PHP execution within the WordPress uploads directory (for example, an Apache directive or nginx location that disables the PHP handler under wp-content/uploads) - the trade-off is that legitimate plugin functionality relying on that handler will break and some plugins that legitimately execute code from uploads could be affected. Restrict administrative and network access to the site and monitor the uploads directory for newly created .php files as a detection measure. Consult the WPScan advisory at https://wpscan.com/vulnerability/05bd2683-ef3b-4816-a323-12d5e943612a/ for exploit details and any updated fix guidance.