CVE-2026-16985

The CVE affects the Squeeze WordPress plugin prior to version 1.7.12. The issue arises because the plugin does not validate the file type or extension of per-size image data written during an attachment-update action, allowing users with the upload_files capability (Author and above) to write an ...