Personal QR Message CVE-2026-16250

Exploitation requires only that the target WordPress site have the Personal QR Message plugin (version ≤1.0) installed and active, exposing its unauthenticated upload handler; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed. No special conditions beyond the plugin's presence - remote unauthenticated exploitation works against default configurations of Personal QR Message because the handler itself does not restrict file types and the uploaded PHP file is directly reachable. The primary limiting factor is deployment scope: the plugin is not widely installed, and exploitation is prevented if the plugin is removed or if the web server denies PHP execution in the upload directory. No specific platform beyond a standard WordPress/PHP stack is required.

The signals largely align toward high real-world severity but with a nuance. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, with full confidentiality, integrity, and availability impact - the textbook profile of a weaponizable unauthenticated RCE, hence the 9.8 base score. Publicly available exploit code (WPScan) further lowers the barrier to exploitation. However, the EPSS score is low at 0.22% (13th percentile), which conflicts with the CVSS picture: this most likely reflects the plugin's limited deployment footprint rather than any difficulty of exploitation, since EPSS weights observed/predicted exploitation volume across the internet. The vulnerability is NOT listed in CISA KEV, so there is no evidence of confirmed active exploitation. Net assessment: technically trivial and high-impact for any instance running the plugin, so it should be treated as urgent for affected sites, but the low EPSS and small install base suggest opportunistic rather than mass exploitation. No SSVC decision data was provided in the input.

An unauthenticated attacker discovers a WordPress site running Personal QR Message and sends a crafted HTTP POST to the plugin's public upload handler carrying a PHP webshell instead of an expected image. Because file types are not restricted, the script lands in a web-reachable directory, and the attacker then requests its URL to execute commands and gain full control of the server. Publicly available exploit code from WPScan makes this attack straightforward to reproduce.