CVE-2026-118235

Summary

The plugin's file upload function lacks proper server-side validation and allows unauthenticated users to upload executable files by exploiting a trailing-dot filename bypass, leading to potential remote code execution.

Exploitability

Exploitation is trivial for unauthenticated attackers because the required nonce is exposed in public HTML and no meaningful access controls or file validation exist.

Blast radius

Successful exploitation could allow full system compromise including data theft, server takeover, and lateral movement within the hosting environment.

Detection

Look for unexpected executable files (e.g., .php, .phtml, .js) uploaded to publicly accessible directories via form submissions; monitor web server access logs for POST requests to upload endpoints with suspicious filenames ending in a dot (e.g., 'malware.php.') and non-standard Content-Type headers.

Prioritized remediation

Upgrade to version 3.10.3 or later, which reportedly patches the vulnerable handle_upload function by enforcing strict file extension allowlists and pre-sanitization.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.