CVE-2026-115212

Summary

The mView 豆瓣电影 WordPress plugin (≤1.0.3) allows any authenticated user—including low-privilege roles like subscribers—to upload arbitrary PHP files due to missing file type validation, capability checks, and authorization enforcement. This enables remote code execution by saving malicious PHP files to a web-accessible directory.

Exploitability

Exploitation is straightforward for any authenticated WordPress user with subscriber-level privileges, requiring no user interaction or special conditions beyond valid login credentials.

Blast radius

Successful exploitation grants full remote code execution with the privileges of the web server process, risking complete site compromise, data exfiltration, and potential lateral movement within the hosting environment.

Detection

Defenders should monitor WordPress upload logs for PHP files uploaded via the plugin’s endpoint (e.g., /wp-admin/admin-ajax.php?action=mview_upload), especially when triggered by low-privilege users; look for HTTP POST requests to upload endpoints with .php extensions and non-image Content-Type or filename headers.

Prioritized remediation

Upgrade to version 1.0.4 or later of the mView 豆瓣电影 plugin, which addresses the vulnerability by implementing proper file validation, capability checks, and access controls.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.