OMGF WordPress Plugin CVE-2026-89417

Exploitation requires that the front-end web server serve the plugin's retained .tmp file (produced by the comments-atom feed download/optimize flow) WITHOUT a Content-Type header and WITHOUT X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser interprets and executes the injected script - a condition the advisory states is present by default on many Apache and nginx/php-fpm deployments. No authentication is required (PR:N). Limiting factors: servers that send X-Content-Type-Options: nosniff or a correct Content-Type on .tmp files are NOT exploitable; non-MIME-sniffing browsers do not execute the payload; and a victim must subsequently access the injected page/file for the script to run.

This is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) frames it as a network-reachable, unauthenticated stored XSS with scope change, which on its face looks highly exploitable. However, the description introduces a critical real-world dependency not captured in the AC:L rating: exploitation only succeeds when the front-end server serves the retained .tmp file WITHOUT a Content-Type or X-Content-Type-Options header, allowing MIME-sniffing browsers (Chromium) to execute the payload. That server-configuration dependency arguably warrants AC:H rather than AC:L, which is why my independent assessment lowers complexity-driven score. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC was supplied - exploitation status is 'no public exploit identified at time of analysis.' Signals are therefore consistent and non-alarming: high-ish CVSS, but no evidence of active exploitation, impact limited to C:L/I:L (script execution in victim browsers, no availability impact), and a non-universal precondition. Priority should be driven by the large install base and the trivial unauthenticated injection vector, tempered by the fact that hardened deployments (X-Content-Type-Options: nosniff) are not exploitable.

An unauthenticated attacker submits a crafted 's' search parameter to the plugin's comments-atom feed, causing a malicious script to be written into a retained .tmp file. When a site visitor later requests that .tmp file and the server returns it without a Content-Type or X-Content-Type-Options header, a MIME-sniffing browser executes the injected JavaScript in the site's origin, enabling session/cookie theft or admin-context actions. No public exploit code was identified in the provided intelligence.