CVE-2026-104028

CriticalCVSS 9.8/10Last modified Oct 13, 2026

Description

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Oct 11, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1040293.3A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNICVE-2026-1040305.5A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkeCVE-2026-1040315.5A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request procesCVE-2026-1040325.5A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due toCVE-2026-1040335.4A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributesCVE-2026-1040344.7A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-grCVE-2026-1040355.5A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS)CVE-2026-1040365.8A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destinatCVE-2026-1040375.5A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to thCVE-2026-1040385.9A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security CVE-2026-1040394.7A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling GenerCVE-2026-1040406.1A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly
CVE-2026-104028: Critical severity, CVSS 9.8 | Vulnix