WordPress AF Companion plugin < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE vulnerability

Shop Manager+ Arbitrary File Upload to RCE vulnerability discovered by Farhan Fawwaz Saputra in WordPress Plugin AF Companion versions 2.2.0...

WordPress WP Cloud Plugins - Dropbox (Out-of-the-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Dropbox Out-of-the-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Out-of-the-Box versions 2.0-3.8.3...

WordPress WP Cloud Plugins - Box (Lets-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Box Lets-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Lets-Box versions 2.0-3.8.3...

WordPress Share-one-Drive | OneDrive & SharePoint plugin for WordPress plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Share-one-Drive versions 2.0-3.8.3...

WordPress Use-your-Drive | Google Drive plugin for WordPress plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Use-your-Drive versions 2.0-3.8.3...

CVE-2026-84738

The AF Companion WordPress plugin, in versions before 2.2.0 , contains a vulnerability where it fails to validate file types during one of its import features . This oversight allows users with a low-privileged store-management role to upload arbitrary files, such as PHP files , resulting in Remo...

CVE-2026-84738 AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

CVE-2026-84738: Improper Control of Generation of Code

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

CVE-2026-93031: Unrestricted Upload of File with Dangerous Type

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

Exploit for CVE-2026-87796

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-87796

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

EUVD-2026-81335

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 1.1.9 . The flaw resides in the move_file function in GFMU_FileUploader.php, where insufficient file type validation during chunked upload handling allo...

CVE-2026-87935 Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

EUVD-2026-81334

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

CVE-2026-87796: Unrestricted Upload of File with Dangerous Type

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87935: Unrestricted Upload of File with Dangerous Type

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.9 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.9...