What is the CVSS score of CVE-2026-57710?

CVE-2026-57710 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WoowBot Pro Max are affected by CVE-2026-57710?

The WoowBot Pro Max WordPress plugin (quantumcloud) through version 14.1.7 contains a critical remote code execution vulnerability (CVE-2026-57710, CVSS 9.9) exploitable by authenticated users,…

How to fix or mitigate CVE-2026-57710?

Within 24 hours: Audit and inventory all WordPress installations using WoowBot Pro Max plugin version 14.1.7 or earlier; immediately deactivate and remove the plugin from all affected systems to eliminate the attack surface. Restrict WordPress user roles to enforce least-privilege access, limiting who can perform file uploads. Within 7 days: Identify and deploy alternative plugins with equivalent functionality or confirm the plugin is non-essential for removal. Implement Web Application Firewall rules to block file uploads with executable file types and monitor upload directories for malicious content. Within 30 days: Subscribe to vendor security advisories and Patchstack notifications to obtain immediate notification of patch release; test and deploy the vendor patch within 48 hours of availability. Conduct a comprehensive plugin security audit of all installed WordPress plugins to identify similar vulnerabilities.

WoowBot Pro Max CVE-2026-57710

EUVD-2026-43365 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-13 Patchstack

WordPress File Upload Wordpress Plugin Woowbot Pro Max Quantumcloud

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable upload endpoint needing only a low-privileged account (PR:L), no interaction, and unrestricted upload yielding code execution that escapes the app scope (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:48 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.9

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.

AnalysisAI

Arbitrary file upload in the WoowBot Pro Max WordPress plugin (quantumcloud) through version 14.1.7 allows an authenticated attacker to upload files of dangerous types, leading to remote code execution on the underlying WordPress host. The scope-change CVSS 9.9 reflects that a low-privileged account can pivot to full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Patchstack has confirmed and cataloged the flaw.

Technical ContextAI

WoowBot Pro Max is a commercial WooCommerce/WhatsApp chatbot plugin for WordPress (CPE cpe:2.3:a:quantumcloud:woowbot_pro_max). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): a plugin upload handler fails to validate file extension, MIME type, or content, permitting a PHP or other executable script to be written into a web-accessible directory. In a WordPress context this typically maps to an AJAX or REST upload endpoint reachable by an authenticated session; once a .php payload lands under wp-content it can be requested directly and executed by the PHP interpreter, converting a file-write primitive into code execution.

RemediationAI

No vendor-released patched version is identified in the provided data (fix listed as n/a), so upgrade to a fixed release once quantumcloud publishes one - track the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woowbot-pro-max/vulnerability/wordpress-woowbot-pro-max-plugin-14-1-7-arbitrary-file-upload-vulnerability for the fixed version. In the interim, apply virtual patching via a WordPress WAF (Patchstack or equivalent) to block the malicious upload request; restrict or remove low-privileged account self-registration to shrink the pool of attackers who meet the PR:L requirement; and harden the WordPress uploads/plugin directories by denying PHP execution (e.g. an .htaccess or nginx rule blocking execution of scripts under wp-content/uploads), accepting that this can break legitimately server-side-processed uploads. If the plugin is not essential, deactivate and remove it until a patch ships.