CVE-2026-118064: Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via featured_action
The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely.
Successful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written.
Affected Software
Event History
Frequently Asked Questions
Which deployments are practically vulnerable to remote code execution?
Sites running Advance Guest Post version 1.9 or earlier on PHP 7.x are vulnerable. On PHP 8.0 and later, the affected code path fails with a fatal error before an uploaded file is written.
Does exploitation require an authenticated WordPress account?
No. The upload action is authorized using a nonce exposed to every front-end visitor, so an unauthenticated attacker can attempt exploitation.
What capability does an attacker gain after successful exploitation?
An attacker can upload an arbitrary PHP file and execute it remotely, which can result in code execution on the affected server.