EUVD-2026-43133
GHSA-xq2v-8qf4-3rg6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable upload needing an Author account gives PR:L and AV:N; the substring bypass is trivially low-complexity (AC:L), and RCE yields full C:H/I:H/A:H; the required non-default feature is a deployment condition rather than an AC increase.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the upload_extension_files() function in all versions up to, and including, 1.4.6. The upload_extension_files() function hooks into WordPress's wp_check_filetype_and_ext filter and uses strpos() to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site's server which may make remote code execution possible, granted the "Enhanced Multi-Format Image Support" feature is enabled with at least one extension (e.g., avif) in the allowed formats.
Articles & Coverage 1
AnalysisAI
Arbitrary file upload in the Swiss Toolkit For WP WordPress plugin (versions ≤ 1.4.6) lets authenticated Author-level (and higher) users bypass file-type validation and upload executable PHP, potentially achieving remote code execution on the host. The flaw stems from the upload_extension_files() function using a substring match instead of a real extension check when the optional 'Enhanced Multi-Format Image Support' feature is enabled. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability lives in the plugin's extension-support component (class-boomdevs-swiss-toolkit-extension-supports.php). The upload_extension_files() function hooks WordPress's wp_check_filetype_and_ext filter - the core mechanism WordPress uses to decide whether an uploaded file's type and extension are permitted. Instead of validating the true file extension, the code calls strpos() to test whether the filename merely contains a configured allowed string (e.g. 'avif'). Because strpos() returns a match for any filename that embeds that substring anywhere (for example 'shell.avif.php' or 'malicious_avif.php'), the check can be satisfied while the file is actually a PHP script. This is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type) caused by trusting a filename substring rather than the canonical extension/MIME type. The affected software per CPE is cpe:2.3:a:wpmessiah:swiss_toolkit_for_wp for all versions through 1.4.6.
RemediationAI
No vendor-released fix version is confirmed in the available data; because the flaw affects all versions through 1.4.6, upgrade to the next release above 1.4.6 once the vendor publishes it and verify the fix against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/06bccd2e-6891-433a-9f5b-3ec0c30afef4?source=cve) - do not assume a specific patched version number. As an immediate compensating control, disable the 'Enhanced Multi-Format Image Support' feature, which removes the vulnerable upload_extension_files() hook entirely (trade-off: loss of avif/multi-format image handling). Additionally, restrict who holds Author-level and higher roles to trusted users only, and configure the web server to deny PHP execution within the WordPress uploads directory (e.g. an .htaccess/nginx rule blocking script handlers under wp-content/uploads), which blocks RCE even if a malicious file lands but may break legitimate plugins that expect to run PHP from uploads. A WAF rule inspecting for double-extension filenames on upload endpoints can serve as an interim detective/preventive layer.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Share
External POC / Exploit Code
Leaving vuln.today