What is the CVSS score of EUVD-2026-57082?

EUVD-2026-57082 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 22.0%.

Which versions of Giftware (WordPress plugin) are affected by EUVD-2026-57082?

The Giftware WordPress plugin contains a critical unauthenticated remote code execution vulnerability (CVE-2026-15039, CVSS 9.8) affecting all versions before 4.2.10.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-57082?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57082. Prioritise patching immediately. EPSS: 22.0%.

How to fix or mitigate EUVD-2026-57082?

Within 24 hours: immediately update the Giftware plugin to version 4.2.10 across all WordPress instances. Within 7 days: verify patch deployment on all sites, audit server logs for exploitation attempts, scan for suspicious file uploads and PHP files created outside normal deployment, and check for signs of unauthorized access. Within 30 days: conduct forensic review of affected servers, reset all WordPress administrative credentials, review database access logs, and implement file upload type validation to prevent recurrence.

Giftware (WordPress plugin) EUVD-2026-57082

| CVE-2026-15039 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-12 WPScan

GHSA-h5c4-q3vg-m4m7

PHP File Upload WordPress RCE Giftware

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote file upload yields code execution with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C/I/A impact on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:33 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

CRITICAL 9.8

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

Articles & Coverage 1

News Critical Arbitrary File Upload RCE in Giftware WordPress Plugin - CVE-2026-15039 Aug 13, 2026

AnalysisAI

Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Locate site running Giftware plugin

Delivery

Send crafted file upload request

Exploit

Bypass missing type validation

Execution

Store PHP webshell in web root

Persist

Request uploaded shell URL

Impact

Execute code as web-server user

Access

Locate site running Giftware plugin

Delivery

Send crafted file upload request

Exploit

Bypass missing type validation

Execution

Store PHP webshell in web root

Persist

Request uploaded shell URL

Impact

Execute code as web-server user

Vulnerability AssessmentAI

Exploitation	The concrete prerequisite is that the site runs the Giftware WordPress plugin at a version below 4.2.10 with the vulnerable upload path reachable; per CVSS AV:N/AC:L/PR:N/UI:N this is remote unauthenticated exploitation requiring no user interaction and no authentication against a default installation of the affected plugin. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All signals point to a genuine high priority rather than a paper-high CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted multipart POST request to the plugin's vulnerable upload endpoint, submitting a PHP webshell disguised as (or simply not validated against) an allowed file type. The file is stored in a web-accessible directory, and the attacker then requests its URL directly to execute arbitrary code as the web-server user. …
Remediation	Vendor-released patch: upgrade the Giftware plugin to version 4.2.10 or later, which is available from the vendor per the WPScan advisory (https://wpscan.com/vulnerability/b7b3308c-430e-4bc3-a3df-da20d47cf314/). … Detailed patch versions, workarounds, and compensating controls in full report.