What is the CVSS score of CVE-2026-28114?

CVE-2026-28114 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-28114?

A critical vulnerability in the WooCommerce License Manager plugin allows attackers to upload malicious files to affected systems, potentially enabling complete server compromise and data theft.

How to fix or mitigate CVE-2026-28114?

Within 24 hours: Disable the WooCommerce License Manager plugin and audit upload directories for suspicious files. Within 7 days: Identify all affected instances across your infrastructure and document inventory; implement network-based controls to restrict file uploads. Within 30 days: Evaluate alternative license management solutions and plan migration strategy; monitor vendor for patch availability and test in non-production environment immediately upon release.

WordPress CVE-2026-28114

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-05 audit@patchstack.com

WordPress File Upload

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in firassaidi WooCommerce License Manager fs-license-manager allows Upload a Web Shell to a Web Server.This issue affects WooCommerce License Manager: from n/a through <= 7.0.6.

AnalysisAI

Deserialization of untrusted data in WooCommerce License Manager (fs-license-manager) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

Technical ContextAI

CWE-502 deserialization of untrusted data in fs-license-manager. Attacker-controlled data is passed to unserialize(), enabling instantiation of arbitrary PHP objects.