CVE-2026-118063

Not scored yetLast modified Nov 13, 2026

Description

The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-118064The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a CVE-2026-118065The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, r CVE-2026-1180669.1The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass CVE-2026-1180675.4The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-118079.6A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint d CVE-2026-1180707.2The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and CVE-2026-1180716.8The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the CVE-2026-1180725.4The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before let CVE-2026-1180738.8Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.CVE-2026-1180747.2Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.CVE-2026-1180758.8Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.CVE-2026-1180768.8Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.