CVE-2026-74016

CriticalCVSS 9.9

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Vulnerability allowing arbitrary file upload by users with Subscriber role in the Smart Cleaning plugin. Affects versions up to 4.8.6.

A user with low privileges can upload dangerous files, potentially leading to malicious code execution on the server.

Update the Smart Cleaning plugin to the latest version and review user permissions.

Original NVD description (English source)

Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.