CVE-2026-84171

The piclect WordPress plugin (versions through 1.0 ) contains an unauthenticated arbitrary file upload in its WP images upload feature. The plugin fails to validate the name or type of uploaded files before writing them to a publicly accessible directory , allowing an unauthenticated attacker ove...