CVE-2026-74014

CriticalCVSS 9.9

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Vulnerability allowing arbitrary file upload by users with Subscriber role in the IT Residence plugin. Affects versions up to 3.2.1.

An attacker with subscriber privileges can upload malicious files, potentially leading to server or site compromise.

Update the IT Residence plugin to a version without this vulnerability and restrict file upload capabilities.

Original NVD description (English source)

Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.