CVE-2026-62025

The Tailored Tools plugin in versions up to and including 3.0.3 contains an unauthenticated arbitrary file upload vulnerability. The lack of required authorization allows exploitation without an account in the application.

An attacker can upload a malicious file (e.g., a webshell), leading to website takeover and code execution on the server. This poses a serious threat to confidentiality, integrity, and availability.

Update the Tailored Tools plugin to a version newer than 3.0.3 or disable it if no update is available. Additionally, consider restricting file upload capabilities at the web server level.