CVE-2026-118063: Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_action
The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit it. No WordPress account or prior access is required.
What does an attacker need to do to exploit it?
An attacker needs to submit an upload through the plugin's gallery_action functionality and bypass its case-sensitive, incomplete extension validation. Successful exploitation allows arbitrary files, including PHP variants, to be placed in a web-reachable directory.
Does successful upload always result in remote code execution?
No. Remote code execution depends on the server configuration, specifically whether the web server executes the uploaded PHP variant from the web-reachable upload location.