What is the CVSS score of CVE-2026-1969?

CVE-2026-1969 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1969?

Organizations using trx_addons WordPress should be aware of moderate risk from CVE-2026-1969, a unrestricted file upload vulnerability rated CVSS 5.3. This could allow unauthorized file access.. A patch is available.

Is there a public PoC exploit available for CVE-2026-1969?

Yes, a public proof-of-concept exploit is available for CVE-2026-1969. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1969?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

WordPress CVE-2026-1969

EUVD-2026-14361 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-23 WPScan

GHSA-qxq6-27j9-fv97

WordPress File Upload

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.38.5

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 06:15 euvd

EUVD-2026-14361

Analysis Generated

Mar 23, 2026 - 06:15 vuln.today

CVE Published

Mar 23, 2026 - 06:00 nvd

MEDIUM 5.3

DescriptionCVE.org

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

AnalysisAI

The trx_addons WordPress plugin before version 2.38.5 contains an arbitrary file upload vulnerability in an AJAX action that fails to properly validate file types, allowing unauthenticated attackers to upload malicious files. This vulnerability represents an incomplete remediation of the previously disclosed CVE-2024-13448, meaning the original patch was insufficient. A public proof-of-concept exploit is available, and the vulnerability can lead to remote code execution or information disclosure depending on server configuration and file placement.

Technical ContextAI

The vulnerability exists in the trx_addons WordPress plugin (CPE: cpe:2.3:a:unknown:trx_addons), which is a theme add-on package for WordPress that provides additional functionality. The root cause is improper input validation in an AJAX action endpoint, likely related to CWE-434 (Unrestricted Upload of File with Dangerous Type). Rather than implementing a whitelist-based approach to validate file extensions and MIME types, the plugin's developers attempted a fix for CVE-2024-13448 that was incomplete, leaving the file upload mechanism still vulnerable to bypass techniques such as double extensions, null-byte injection, or MIME type spoofing. The AJAX action processes file uploads without adequate server-side validation, treating user-supplied file type declarations as trustworthy.

RemediationAI

Immediately upgrade the trx_addons WordPress plugin to version 2.38.5 or later to apply the corrected file type validation. Site administrators should verify the upgrade through the WordPress plugin dashboard or via the WPScan vulnerability reference (https://wpscan.com/vulnerability/762530ae-80a5-4ff8-9725-6adab9498c33/). As a temporary workaround pending patch availability, restrict AJAX access to the vulnerable endpoints by implementing Web Application Firewall (WAF) rules that block file upload requests to the trx_addons AJAX handlers, or disable the plugin entirely if its functionality is not critical. Additionally, review upload directories (typically wp-content/uploads) for suspicious files that may have been uploaded during the exposure window and audit access logs for evidence of exploitation.