EUVD-2026-43133
GHSA-xq2v-8qf4-3rg6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain Author-level WordPress account
-
DeliveryEnable/confirm multi-format image feature active
-
ExploitCraft PHP file with allowed-extension substring name
-
InstallUpload via extension file handler bypassing strpos check
-
C2Request uploaded file URL
-
ExecuteExecute arbitrary PHP as web server
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with Author-level privileges or higher (per CVSS PR:L), AND the plugin's optional 'Enhanced Multi-Format Image Support' feature must be enabled with at least one extension (e.g. avif) configured in the allowed formats - this is the exact non-default configuration that activates the vulnerable upload_extension_files() hook. Limiting factors that reduce real-world risk: it is not exploitable by anonymous/unauthenticated visitors, it does not affect default installations where the multi-format feature is off, and it depends on the site issuing Author (or higher) roles to the attacker. Where those conditions hold, no user interaction is needed and the upload is network-reachable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) reflects network-reachable exploitation with low complexity, low privileges, no user interaction, and full CIA impact - consistent with file-upload-to-RCE. However, two real-world limiters temper the raw score: exploitation requires an authenticated Author-level (or higher) account (PR:L), and the vulnerable code path only exists when the non-default 'Enhanced Multi-Format Image Support' feature is enabled with at least one allowed extension. No EPSS score, KEV entry, SSVC decision, or POC was provided in the input, so there is no evidence of active or automatable exploitation at this time - this is a high-impact but pre-exploitation issue whose realistic priority depends heavily on whether the optional feature is enabled and whether low-trust users hold Author accounts. Sites that grant Author roles to semi-trusted contributors and have the feature on should treat this as high priority; sites without the feature or with tightly controlled roles face materially lower exposure. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted an Author-level WordPress account on a site running Swiss Toolkit For WP ≤ 1.4.6 with the multi-format image feature enabled uploads a file named to embed an allowed substring while carrying PHP content (e.g. 'evil_avif.php'). The strpos() check passes, the PHP file is written to the server, and the attacker requests the uploaded file's URL to execute code and take over the site. No public exploit code was identified in the provided data, but the technique is straightforward and low-complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Arbitrary file upload in the Swiss Toolkit For WP WordPress plugin (versions ≤ 1.4.6) lets authenticated Author-level (and higher) users bypass file-type validation and upload executable PHP, potentially achieving remote code execution on the host. The flaw stems from the upload_extension_files() function using a substring match instead of a real extension check when the optional 'Enhanced Multi-Format Image Support' feature is enabled. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis.
RemediationAI
No vendor-released fix version is confirmed in the available data; because the flaw affects all versions through 1.4.6, upgrade to the next release above 1.4.6 once the vendor publishes it and verify the fix against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/06bccd2e-6891-433a-9f5b-3ec0c30afef4?source=cve) - do not assume a specific patched version number. As an immediate compensating control, disable the 'Enhanced Multi-Format Image Support' feature, which removes the vulnerable upload_extension_files() hook entirely (trade-off: loss of avif/multi-format image handling). Additionally, restrict who holds Author-level and higher roles to trusted users only, and configure the web server to deny PHP execution within the WordPress uploads directory (e.g. an .htaccess/nginx rule blocking script handlers under wp-content/uploads), which blocks RCE even if a malicious file lands but may break legitimate plugins that expect to run PHP from uploads. A WAF rule inspecting for double-extension filenames on upload endpoints can serve as an interim detective/preventive layer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the plugin's extension-support component (class-boomdevs-swiss-toolkit-extension-supports.php). The upload_extension_files() function hooks WordPress's wp_check_filetype_and_ext filter - the core mechanism WordPress uses to decide whether an uploaded file's type and extension are permitted. Instead of validating the true file extension, the code calls strpos() to test whether the filename merely contains a configured allowed string (e.g. 'avif'). Because strpos() returns a match for any filename that embeds that substring anywhere (for example 'shell.avif.php' or 'malicious_avif.php'), the check can be satisfied while the file is actually a PHP script. This is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type) caused by trusting a filename substring rather than the canonical extension/MIME type. The affected software per CPE is cpe:2.3:a:wpmessiah:swiss_toolkit_for_wp for all versions through 1.4.6.
Know when Swiss Toolkit For Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable upload needing an Author account gives PR:L and AV:N; the substring bypass is trivially low-complexity (AC:L), and RCE yields full C:H/I:H/A:H; the required non-default feature is a deployment condition rather than an AC increase.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the upload_extension_files() function in all versions up to, and including, 1.4.6. The upload_extension_files() function hooks into WordPress's wp_check_filetype_and_ext filter and uses strpos() to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site's server which may make remote code execution possible, granted the "Enhanced Multi-Format Image Support" feature is enabled with at least one extension (e.g., avif) in the allowed formats.
Articles & Coverage 1
Executive ViewAI
Swiss Toolkit For WP WordPress plugin (versions ≤1.4.6) contains an authenticated file upload vulnerability allowing Author-level users to bypass validation and upload malicious PHP code, creating an immediate remote code execution risk on affected WordPress installations. Organizations running this plugin face potential website takeover, data theft, and service disruption, particularly if the WordPress environment processes sensitive data or customer transactions. Immediate remediation is critical as no patch has been released by the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the 'Enhanced Multi-Format Image Support' feature to prevent the substring-match bypass, if feature flagging is available; (2) Restrict Author-level role assignment to trusted administrators only; (3) Implement Web Application Firewall rules to block .php file uploads to plugin directories; (4) Enable WordPress file upload audit logging and real-time monitoring for suspicious uploads; (5) Conduct weekly file integrity checks on upload directories to detect unauthorized PHP files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB