Tailored Tools EUVD-2026-96463

The vulnerable code path is the Tailored Tools plugin's file upload functionality, reachable by unauthenticated users (PR:N, UI:N, AV:N) on any WordPress site with the plugin installed at version 3.0.3 or earlier. Exploitation requires that the site actually runs this specific plugin at an affected version, and the CVSS AC:H indicates a non-default or non-trivial precondition - likely path/filename guessing, a specific plugin configuration, or a timing/state requirement - that an attacker must satisfy for a successful upload. The principal limiting factors are the plugin's narrow deployment footprint and this elevated attack complexity; there is no required authentication or user interaction to constrain the attacker.

This is a CWE-434 unauthenticated arbitrary file upload in the Tailored Tools WordPress plugin (<= 3.0.3), scored CVSS 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). The strongest risk signals are PR:N (no authentication) and arbitrary file upload, which in WordPress typically yields webshell upload and full remote code execution - hence the C:H/I:H/A:H with scope-changed (S:C). The one mitigating signal in the supplied vector is AC:H (high attack complexity), which suggests some non-trivial precondition, race, or timing/path-guessing requirement rather than a trivial one-shot upload; this partially explains why the score is 9.0 rather than 9.8/10.0. No EPSS probability, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' Note a tension worth verifying: the CVSS vector asserts AC:H, yet the description ('Unauthenticated Arbitrary File Upload') reads like a straightforward low-complexity flaw - confirm with Patchstack whether a real precondition justifies AC:H, because if it is actually AC:L the real-world risk is higher than the raw score implies. Overall this is a genuinely high-severity flaw for any site running the affected plugin, but real-world priority is tempered by the plugin's likely small install base and the absence of exploitation evidence.

A remote, unauthenticated attacker locates a WordPress site running Tailored Tools <= 3.0.3 and submits a crafted request to the plugin's file upload handler, placing a malicious PHP file within the webroot. The attacker then requests that file to obtain code execution and a webshell on the server. No public POC is identified in the provided data, and the CVSS AC:H indicates exploitation may require a non-trivial condition (e.g., guessing an upload path or meeting a specific state) rather than a trivial single request.