WordPress Webinfos plugin <= 1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Webinfos versions = 1.2...

CVE-2026-12872

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

CVE-2026-12872 Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

CVE-2026-12872

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

CVE-2026-12872

The Webinfos WordPress plugin (versions through 1.2 ) is vulnerable to an unauthenticated arbitrary file upload vulnerability. The software fails to validate the type or name of uploaded files and lacks authentication, capability, or nonce checks for the upload action. This allows unauthenticated...

CVE-2026-12872 Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

PT-2026-67021

Name of the Vulnerable Software and Affected Versions Webinfos WordPress plugin versions prior to 1.3 Description The plugin fails to validate the type or name of uploaded files and does not restrict the upload action with authentication, capability, or nonce checks. This allows unauthenticated...

CVE-2026-12872: Unrestricted Upload of File with Dangerous Type

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...