CVE-2026-14489
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including, 6.9. This allows authenticated attackers with Custom-level access and above to upload arbitrary files to the server, potentially leading to remote code execution.
Risk Assessment
The risk involves potential remote code execution by an authenticated attacker, which could lead to full server compromise and data breach.
Recommendation
It is recommended to immediately update the WHMCS Bridge plugin to the latest available version and restrict user permissions to the minimum necessary.
Original NVD description (English source)
The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.