CVE-2026-6101
HighCVSS 7.5Summary
The AMP for WP – Accelerated Mobile Pages plugin for WordPress up to version 1.1.12 contains an arbitrary file write vulnerability. It is due to unsafe ZIP extraction in the ampforwp_save_local_font() function and inadequate cleanup that fails to remove nested directories and files.
Risk Assessment
An authenticated attacker with Author-level access or higher, after obtaining permissions from an Administrator, can write arbitrary files to a web-accessible location on the server. This could lead to remote code execution on hosts that execute PHP files in the uploads directory.
Recommendation
It is recommended to immediately update the AMP for WP plugin to the latest available version. Additionally, restrict user permissions and regularly audit write permissions in the uploads directory.
Original NVD description (English source)
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.