What is the CVSS score of EUVD-2026-42041?

EUVD-2026-42041 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of AMP for WP are affected by EUVD-2026-42041?

The AMP for WP WordPress plugin (versions through 1.1.12) contains a file-upload vulnerability exposing WordPress installations to potential unauthorized code execution.

How to fix or mitigate EUVD-2026-42041?

Within 24 hours: Identify WordPress installations running AMP for WP (versions ≤1.1.12) and determine whether PHP execution is enabled in the uploads directory. Within 7 days: Disable the plugin on affected systems or, if operationally required, tightly restrict Author permissions to exclusively trusted personnel. Within 30 days: Deploy vendor patch once released, or continue compensating controls if plugin removal is infeasible.

AMP for WP EUVD-2026-42041

| CVE-2026-6101 HIGH

External Control of File Name or Path (CWE-73)

2026-07-07 Wordfence

GHSA-gw54-4vv6-gpqx

PHP WordPress RCE Wordpress Plugin Amp For Wp Accelerated Mobile Pages

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable admin function (AV:N) but needs Author+ account with an admin-granted capability (PR:L) plus crafted ZIP and PHP-executing uploads (AC:H), yielding full RCE impact (C/I/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 14:20 vuln.today

CVE Published

Jul 07, 2026 - 13:32 cve.org

HIGH 7.5

DescriptionCVE.org

The AMP for WP - Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.

AnalysisAI

Arbitrary file write in the AMP for WP - Accelerated Mobile Pages WordPress plugin (versions up to and including 1.1.12) lets authenticated Author-level users, granted permission by an Administrator, upload and unsafely extract a crafted ZIP through the ampforwp_save_local_font() function, planting attacker-controlled files in a web-accessible uploads path. On hosts configured to execute PHP from the uploads directory, this escalates to remote code execution. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; an upstream fix is present in the plugin repository (changeset 3512870).

Technical ContextAI

The vulnerability lives in AMP for WP's local-font handling, which accepts a user-supplied ZIP archive and extracts it server-side via ampforwp_save_local_font(). The root cause maps to CWE-73 (External Control of File Name or Path): the extraction routine does not sanitize archive member paths, and an inadequate cleanup step fails to remove nested directories and files, so an attacker controls both filename and destination path of written content. The plugin bundles the Redux framework (includes/options/redux-core/framework.php, referenced at the disclosed source lines) for its options/upload plumbing, and the write lands under the WordPress uploads directory. The CPE cpe:2.3:a:mohammed_kaludi:amp_for_wp_-_accelerated_mobile_pages:*:*:*:* confirms the affected component is the AMP for WP plugin authored by Mohammed Kaludi, not the WordPress core. RCE is contingent on the web server executing PHP files placed in wp-content/uploads.

RemediationAI

Upgrade AMP for WP to the fixed release published in the plugin repository; an upstream fix is available via WordPress.org changeset 3512870 (https://plugins.trac.wordpress.org/changeset/3512870/), so update to the first tagged version above 1.1.12 that includes this changeset - the released patched version number is not independently confirmed from the input, so verify the target version against the plugin changelog before deploying. As compensating controls until patched: revoke the Administrator-granted font/options capability from Author and Contributor roles so only trusted Administrators can invoke the local-font upload, and audit existing non-admin users for that permission. At the hosting layer, prevent PHP execution in the uploads directory (e.g., a deny rule for wp-content/uploads/*.php via .htaccess, nginx location block, or disabling the PHP handler for that path) - this breaks the RCE chain while leaving legitimate media serving intact, though it may interfere with rare plugins that intentionally run PHP from uploads. Restrict or monitor access to the plugin's font-upload admin endpoint via a WAF rule as an additional layer. Advisory reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/b594d0e9-d805-48b9-bfd4-4cc77dd3a70e?source=cve.