CVE-2026-118064
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 13, 2026
Vendor
unknown
Description
The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely. Successful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written.