YAHMAN Add-ons EUVD-2026-85024

Requires the YAHMAN Add-ons plugin (version before 0.9.31) installed AND its remote-file caching feature explicitly enabled - the description states 'when the relevant feature is enabled,' making this a non-default configuration prerequisite. The caching directory must be publicly accessible (default plugin behavior per the advisory) and the attacker must be able to reach the cache-triggering endpoint. Limiting factors: exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), but the feature-enablement gate plus AC:H complexity meaningfully narrow the realistically-exploitable population; the product's obscurity further limits opportunistic attacks.

CVSS 9.0 (CRITICAL) reflects an unauthenticated network-reachable RCE with full C:H/I:H/A:H and scope change (S:C). However, two signals temper the raw score: AC:H indicates non-trivial attack complexity, and the description explicitly gates exploitation on 'when the relevant feature is enabled' - a non-default configuration dependency the CVSS vector does not otherwise capture. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - the risk is currently theoretical rather than observed. The affected product is an obscure WordPress plugin (YAHMAN Add-ons), so real-world attack surface is narrow despite the WordPress ecosystem's ubiquity. Note also a defensible scope disagreement: WPScan assigned S:C, but arbitrary PHP written and executed within the web server's own security authority is arguably S:U, which would lower the score to roughly 8.1. Net: a genuine unauth-RCE class bug that warrants prompt patching where the plugin AND its caching feature are in use, but the low deployment footprint and feature-gating make it a targeted rather than mass-exploitation concern.

An unauthenticated attacker identifies a WordPress site running YAHMAN Add-ons (<0.9.31) with the remote-file caching feature enabled, then supplies a remote URL pointing to malicious PHP. Because the plugin does not validate the cached file's type and stores it in a publicly accessible directory, the attacker's PHP webshell lands on disk and is directly requestable, yielding remote code execution in the web server context. No public exploit code was identified at time of analysis, and the AC:H rating implies some conditions (feature enabled, correct cache path/predictable location) must align.