EUVD-2026-57082
GHSA-h5c4-q3vg-m4m7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate site running Giftware plugin
-
DeliverySend crafted file upload request
-
ExploitBypass missing type validation
-
ExecutionStore PHP webshell in web root
-
PersistRequest uploaded shell URL
-
ImpactExecute code as web-server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The concrete prerequisite is that the site runs the Giftware WordPress plugin at a version below 4.2.10 with the vulnerable upload path reachable; per CVSS AV:N/AC:L/PR:N/UI:N this is remote unauthenticated exploitation requiring no user interaction and no authentication against a default installation of the affected plugin. The primary limiting factors are deployment-specific: the target must actually have this niche plugin installed and active, the upload endpoint must be network-reachable (not blocked by a WAF or access controls), and server hardening that prevents PHP execution within the uploads directory would blunt code execution even if a file is uploaded. |
| Impact | All signals point to a genuine high priority rather than a paper-high CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) indicates remote, low-complexity, unauthenticated exploitation with full impact, which is consistent with the described unauthenticated arbitrary file upload leading to RCE. A public exploit exists (WPScan/cveorg reference), which materially raises real-world risk. The EPSS score of 22% is elevated relative to typical CVEs but not extreme, suggesting active interest without yet-confirmed mass exploitation; this is coherent with the absence of a CISA KEV listing. No signals conflict here: CVSS, CWE-434, the description, and POC availability all align on unauthenticated RCE. The main uncertainty is deployment footprint of the plugin, which moderates aggregate exposure but not per-instance severity. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted multipart POST request to the plugin's vulnerable upload endpoint, submitting a PHP webshell disguised as (or simply not validated against) an allowed file type. The file is stored in a web-accessible directory, and the attacker then requests its URL directly to execute arbitrary code as the web-server user. A public exploit referenced by WPScan lowers the skill and effort required, and the low attack complexity (AC:L) means no special timing or configuration is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 12, 2026
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
RemediationAI
Vendor-released patch: upgrade the Giftware plugin to version 4.2.10 or later, which is available from the vendor per the WPScan advisory (https://wpscan.com/vulnerability/b7b3308c-430e-4bc3-a3df-da20d47cf314/). Until the upgrade is applied, restrict or disable the vulnerable upload endpoint at the web-server or WAF layer, and deny direct execution of PHP within the WordPress uploads directory (for example, an Apache 'php_admin_flag engine off' or an equivalent Nginx location block preventing PHP handling under wp-content/uploads) - note this can break legitimate features that rely on serving dynamic content from that path. Additionally, block or rate-limit unauthenticated requests to the plugin's upload handler and monitor the uploads directory for newly created .php files; if the plugin is not essential, deactivate and remove it entirely as the most reliable interim control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in a file-upload handler exposed by the Giftware plugin for WordPress, a PHP application typically served under an Apache/Nginx + PHP-FPM stack where uploaded files land in a web-accessible directory (commonly wp-content/uploads). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the affected upload path accepts a file without validating its MIME type or extension against an allowlist, so a script such as a .php file can be stored and subsequently requested directly. Because WordPress passes .php requests to the PHP interpreter, an attacker-controlled script executes in the web server's security context. The CPE cpe:2.3:a:unknown:giftware identifies the plugin generically (vendor recorded as 'unknown'), and the affected range per ENISA EUVD is all versions from 0 up to (but not including) 4.2.10.
Know when Giftware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote file upload yields code execution with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C/I/A impact on the host.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.
Articles & Coverage 1
Executive ViewAI
The Giftware WordPress plugin contains a critical unauthenticated remote code execution vulnerability (CVE-2026-15039, CVSS 9.8) affecting all versions before 4.2.10. Attackers can bypass all authentication to upload and execute malicious code on affected WordPress servers, potentially gaining complete control of web infrastructure and data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB