CVE-2026-16250
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The 'Personal QR Message' WordPress plugin through version 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
Risk Assessment
An unauthenticated attacker can upload a malicious PHP file and achieve remote code execution on the server, potentially leading to full site takeover.
Recommendation
Immediately remove or replace the plugin with a more secure solution, as no patch is available.
Original NVD description (English source)
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.