Gp Premium
Monthly
Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The low privilege barrier (any Contributor) combined with high confidentiality, integrity and availability impact makes this a severe multi-tenant and membership-site risk.
Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The low privilege barrier (any Contributor) combined with high confidentiality, integrity and availability impact makes this a severe multi-tenant and membership-site risk.