CVE-2026-1969

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 23, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-196938.1extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component,CVE-2026-196945.5TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196955.5Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196965.5Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows CVE-2026-196976.8The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with CVE-2026-196983.5The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CS CVE-2026-196992.7The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users wi CVE-2026-19706.1A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. Th CVE-2026-197027.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technolo CVE-2026-197045.3The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inj CVE-2026-197085.9The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in CVE-2026-197095.3The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before c