What is the CVSS score of EUVD-2026-55014?

EUVD-2026-55014 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Squeeze WordPress Plugin are affected by EUVD-2026-55014?

The Squeeze WordPress plugin before version 1.7.12 contains a remote code execution vulnerability exploitable by any user with standard author-level access, affecting potentially thousands of…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-55014?

Yes, a public proof-of-concept exploit is available for EUVD-2026-55014. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-55014?

Within 24 hours, audit all WordPress installations to identify deployment of the Squeeze plugin and document current versions across the environment. Within 7 days, update all instances to Squeeze version 1.7.12 or later, beginning with production and customer-facing systems. Within 30 days, verify patch deployment across all infrastructure, audit user role assignments to ensure upload_files capability is restricted to necessary personnel only, and review server logs for evidence of suspicious file uploads or PHP execution.

Squeeze WordPress Plugin EUVD-2026-55014

| CVE-2026-16985 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-10 WPScan

GHSA-fwrm-w2w9-jm5f

PHP WordPress RCE File Upload Squeeze Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered upload via HTTP requires only an Author credential (PR:L); no complexity barriers exist; successful PHP execution yields full RCE with complete C/I/A impact on the web server.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:30 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

8.8 (HIGH)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 8.8

DescriptionCVE.org

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.

AnalysisAI

Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.

Technical ContextAI

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), a well-understood class of flaw in which server-side code accepts user-supplied files without enforcing allowlisted MIME types or extensions before writing them to disk. In this case, the Squeeze plugin processes per-size image metadata through an attachment-update action and directly writes the supplied data to the WordPress uploads directory - a path typically served statically by the web server and therefore executable as PHP by default Apache/nginx configurations. CPE cpe:2.3:a:unknown:squeeze:*:*:*:*:*:*:*:* covers all versions below 1.7.12; the vendor field is unresolved in NVD. WordPress's native capability system grants upload_files to Author (role level 2) and higher by default, meaning any registered contributor promoted to Author is a valid threat actor without any further privilege escalation.

RemediationAI

Update the Squeeze WordPress plugin to version 1.7.12 or later immediately; this release introduces proper file type and extension validation on the affected attachment-update action. Patch details are available via the WPScan advisory at https://wpscan.com/vulnerability/045a15f3-5750-4c4e-977d-e1283e3c967d/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-16985. If patching cannot be applied immediately, two compensating controls are available with noted trade-offs: first, add a server-level rule (Apache .htaccess or nginx location block) to deny PHP execution within the wp-content/uploads directory - this is a broadly recommended WordPress hardening step that may break any plugin legitimately executing PHP from uploads, which is rare but possible; second, temporarily revoke the upload_files capability from all non-administrator roles via a capability management plugin, which will prevent media uploads by Authors entirely until the patch is applied.