CVE-2026-115212: mView <= 1.0.3 - Subscriber+ Arbitrary File Upload

Q: Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The issue does not require elevated WordPress capabilities or authorization checks.

Q: What does an attacker need to do to achieve code execution?

The attacker needs a valid authenticated account and must cause the plugin to fetch a malicious PHP file remotely. Because the plugin saves the fetched file to a web-accessible directory without validating its type, name, or source, the uploaded PHP can be executed remotely.

Q: Are sites affected under default low-privilege user configurations?

Yes. Sites that allow users to authenticate as Subscribers are exposed because Subscriber-level access is sufficient; no administrative role is required.

Q: How can I determine whether my site is affected?

Check whether the WordPress site uses the mView 豆瓣电影 plugin at version 1.0.3 or earlier. Also review web-accessible plugin upload or storage directories for unexpected PHP files, particularly files that may have been retrieved from remote sources.

Published Nov 9, 2026

Updated

The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.

Affected Software

1 affected component

WordPress mView 豆瓣电影<=1.0.3

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The issue does not require elevated WordPress capabilities or authorization checks.

What does an attacker need to do to achieve code execution?

The attacker needs a valid authenticated account and must cause the plugin to fetch a malicious PHP file remotely. Because the plugin saves the fetched file to a web-accessible directory without validating its type, name, or source, the uploaded PHP can be executed remotely.

Are sites affected under default low-privilege user configurations?

Yes. Sites that allow users to authenticate as Subscribers are exposed because Subscriber-level access is sufficient; no administrative role is required.

How can I determine whether my site is affected?

Check whether the WordPress site uses the mView 豆瓣电影 plugin at version 1.0.3 or earlier. Also review web-accessible plugin upload or storage directories for unexpected PHP files, particularly files that may have been retrieved from remote sources.

CVE-2026-115212: mView <= 1.0.3 - Subscriber+ Arbitrary File Upload

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to achieve code execution?

Are sites affected under default low-privilege user configurations?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to achieve code execution?

Are sites affected under default low-privilege user configurations?

How can I determine whether my site is affected?