What is the CVSS score of CVE-2026-66665?

CVE-2026-66665 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Type Hub are affected by CVE-2026-66665?

The Type Hub WordPress plugin (versions ≤2.0.6) contains a critical unauthenticated file upload vulnerability (CVSS 10.0) enabling remote code execution and complete site compromise without…

How to fix or mitigate CVE-2026-66665?

Within 24 hours: Identify all WordPress installations running Type Hub plugin versions 2.0.6 or earlier and immediately deactivate the plugin via WordPress admin panel or direct file removal; review upload directories for suspicious files or evidence of exploitation. Within 7 days: Conduct full forensic analysis on any internet-exposed instance that ran this plugin, review access logs for unauthorized upload activity, and implement a Web Application Firewall rule to block POST requests to plugin upload endpoints as temporary hardening. Within 30 days: Monitor the Type Hub plugin repository for security patch release; apply the patch immediately when available; if no patch timeline is provided, select an alternative plugin and migrate away from Type Hub; implement WordPress-wide hardening including file upload restrictions and execution permission denials in the uploads directory.

Type Hub CVE-2026-66665

EUVD-2026-53891 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-06 Patchstack

GHSA-pg7v-726m-f23v

WordPress File Upload Wordpress Plugin Type Hub

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network-reachable file upload with no interaction (AV:N/AC:L/PR:N/UI:N) yields RCE that escapes the plugin scope (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:40 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.

AnalysisAI

Unauthenticated arbitrary file upload in the Type Hub WordPress plugin (versions ≤ 2.0.6) lets remote attackers upload malicious files without any credentials, typically leading to remote code execution and full site compromise. The CVSS 3.1 base score is a maximum 10.0 with a changed scope (S:C), reflecting that a successful upload can pivot beyond the plugin into the underlying host. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it an urgent patch priority.

Technical ContextAI

Type Hub is a WordPress plugin published by BrandExponents (CPE cpe:2.3:a:brandexponents:type_hub), used for typography/font management within WordPress sites. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): a plugin endpoint accepts file uploads without validating the file type, extension, or content, allowing an attacker to place executable PHP (or similar server-interpreted) files into a web-accessible location. Because WordPress plugins run inside the PHP application context, an uploaded web shell executes with the privileges of the web server user, and the CVSS changed-scope flag indicates impact can extend beyond the vulnerable component to the broader hosting environment.

RemediationAI

No vendor-released patch version was identified in the available data, so the exact fixed release cannot be cited; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/typehub/vulnerability/wordpress-type-hub-plugin-2-0-6-arbitrary-file-upload-vulnerability?_s_id=cve) and the vendor for an update beyond 2.0.6 and apply it as the primary fix. Until a confirmed patched version is available, the safest compensating control is to deactivate and remove the Type Hub plugin, which fully eliminates the vulnerable upload endpoint at the cost of losing the plugin's typography functionality. If removal is not acceptable, restrict access to the plugin's upload handler via web-server rules or a WAF (Patchstack offers virtual patching), block execution of PHP within the WordPress uploads directory (e.g., an uploads-directory deny rule for .php), and monitor the filesystem for newly written executable files - noting that WAF/virtual-patch rules can be bypassed and are a temporary measure rather than a true fix.