What is the CVSS score of CVE-2026-4808?

CVE-2026-4808 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-4808?

The Gerador de Certificados - DevApps WordPress plugin (versions 1.3.6 and earlier) contains an arbitrary file upload vulnerability that allows authenticated administrators to execute remote code by…

How to fix or mitigate CVE-2026-4808?

Within 24 hours: Identify all WordPress instances using Gerador de Certificados - DevApps plugin and document current versions via dashboard or database query. Within 7 days: Disable or remove the plugin from all production environments; if operational necessity exists, restrict administrative access to trusted users only and implement file upload monitoring. Within 30 days: Monitor vendor advisory channels for patch release; evaluate alternative certificate generation solutions or request plugin update from DevApps maintainers.

WordPress CVE-2026-4808

EUVD-2026-20113 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-08 Wordfence

GHSA-cxxj-p725-cqqv

WordPress RCE File Upload

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20113

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

HIGH 7.2

DescriptionCVE.org

The Gerador de Certificados - DevApps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moveUploadedFile() function in all versions up to, and including, 1.3.6. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

Arbitrary file upload in Gerador de Certificados - DevApps plugin for WordPress (all versions ≤1.3.6) enables authenticated administrators to upload files without type validation, creating remote code execution opportunities. The vulnerability stems from missing file type validation in the moveUploadedFile() function. CVSS 7.2 (High) reflects network-accessible attack requiring high privileges; EPSS data not provided, no public exploit identified at time of analysis, not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the moveUploadedFile() function within the plugin's admin class (class-devapps-certificate-generator-admin.php, line 346). This function handles file uploads without implementing proper MIME type or extension validation, a classic manifestation of CWE-434 (Unrestricted Upload of File with Dangerous Type). In WordPress environments, unrestricted file upload vulnerabilities allow attackers to place executable PHP scripts in web-accessible directories, bypassing application logic to execute arbitrary server-side code. The affected product (CPE 2.3:a:tidevapps:gerador_de_certificados_-_devapps) is a certificate generation plugin for WordPress, where file upload functionality likely supports certificate template or image uploads but fails to restrict dangerous file types like .php, .phtml, or .phar.

RemediationAI

WordPress administrators should immediately update the Gerador de Certificados - DevApps plugin to a version newer than 1.3.6 once available; check the WordPress plugin repository or vendor notifications for patched releases. Upstream fix available (PR/commit); released patched version not independently confirmed from available data. Until a patch is applied, consider temporarily deactivating the plugin if certificate generation functionality is not business-critical. Implement additional security controls including restricting WordPress admin panel access via IP allowlisting, enforcing strong multi-factor authentication for all administrator accounts, and deploying web application firewall rules to block suspicious file upload patterns (files with double extensions, PHP extensions, null byte injections). Monitor server directories for unexpected .php files and review upload directories for unauthorized content. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/870bf5fe-00c6-48fe-b9e6-e8233c689b71?source=cve for additional mitigation guidance and subscribe to vendor security notifications for patch availability announcements.