Wpjam Basic EUVD-2026-15887

Authenticated user with upload privileges in WPJAM Basic WordPress plugin version 6.9.2 or earlier. Attacker must have login credentials to access the plugin's file upload functionality to upload malicious files.

Although formal CVSS and EPSS scores are not provided, the inherent characteristics of CWE-434 vulnerabilities in WordPress plugins indicate substantial real-world risk. File upload vulnerabilities are typically low in attack complexity and require no special privileges, making them attractive to threat actors. The fact that this issue was reported by Patchstack (a reputable WordPress security vendor) and assigned an ENISA EUVD ID (EUVD-2026-15887) suggests it has undergone formal security review. The absence of published CVSS/EPSS metrics may indicate the vulnerability is either recently disclosed or still under embargo. Given that WPJAM Basic is a publicly available plugin with a known affected version range, proof-of-concept exploitation is likely feasible and may already exist in the wild. This should be treated as a high-priority vulnerability requiring immediate patching, particularly for exposed WordPress installations.

An unauthenticated attacker visits a WordPress site running vulnerable WPJAM Basic and locates the plugin's file upload endpoint. The attacker uploads a PHP webshell disguised with a benign extension or bypasses client-side validation, resulting in code execution on the server. From this foothold, the attacker can install backdoors, harvest credentials, modify site content, or pivot to internal networks. Given the low attack complexity typical of file upload flaws, this exploit can be automated and chained with other WordPress attacks.