CVE-2026-3464

creationtimestamp| type| source ---|---|--- 2026-04-17 17:20:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpgq22aty2c 2026-04-17 18:50:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjplpxhqwg2f 2026-04-17 19:27:20+00:00| seen|...

CVE-2026-3464

The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajaxattachfile' function in all versions up to, and including, 8.3.4. This makes it possible for authenticated attackers with a role that an administrator...