Monthly
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Unauthenticated path-traversal file writes in the EnergizeLab Eilik and EilikO AI skill upload endpoint allow any remote attacker who can reach the FastAPI AI inference and profiling service to write arbitrary files on the robot's host system by supplying crafted traversal filenames in an upload request. Because the endpoint enforces neither authentication nor path constraints, exploitation is a straightforward, low-complexity primitive that lets an attacker tamper with the AI skill files the robots execute, degrading or subverting robot behavior and causing high integrity and availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-434); confidentiality is assessed as unaffected. The practical limiting factor is network reachability rather than credentials or configuration - these are consumer robots whose service is normally confined to the local network segment, so real-world exposure is materially narrower than the AV:N vector implies, and no public exploit code or confirmed active exploitation was identified at time of analysis (the flaw itself needs no user interaction or non-default toggle once the endpoint is reachable).
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Unauthenticated path-traversal file writes in the EnergizeLab Eilik and EilikO AI skill upload endpoint allow any remote attacker who can reach the FastAPI AI inference and profiling service to write arbitrary files on the robot's host system by supplying crafted traversal filenames in an upload request. Because the endpoint enforces neither authentication nor path constraints, exploitation is a straightforward, low-complexity primitive that lets an attacker tamper with the AI skill files the robots execute, degrading or subverting robot behavior and causing high integrity and availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-434); confidentiality is assessed as unaffected. The practical limiting factor is network reachability rather than credentials or configuration - these are consumer robots whose service is normally confined to the local network segment, so real-world exposure is materially narrower than the AV:N vector implies, and no public exploit code or confirmed active exploitation was identified at time of analysis (the flaw itself needs no user interaction or non-default toggle once the endpoint is reachable).
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.