CVE-2026-12872
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Webinfos WordPress plugin through version 1.2 does not validate the type or name of uploaded files, nor does it require authentication or a nonce check for the upload action. This allows unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.
Risk Assessment
An attacker can gain full control over the web server by executing arbitrary PHP code, potentially leading to data theft, content modification, or further attacks on the infrastructure.
Recommendation
Immediately update the Webinfos plugin to the latest version or remove it entirely if no patch is available. Additionally, restrict file uploads to authenticated users with appropriate permissions.
Original NVD description (English source)
The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.