CVE-2026-121497: Askany < 2.2.0 - Unauthenticated Arbitrary File Upload
The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AskAnyto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites using an AskAny WordPress plugin version earlier than 2.2.0 are exposed if visitor attachments are enabled. Exploitation does not require authentication.
What does an attacker need to exploit this issue?
An attacker needs access to the visitor chat attachment feature. They can submit a PHP file while supplying a browser-controlled file type that the plugin trusts.
What is the likely impact of successful exploitation?
A successful attacker can upload and execute arbitrary PHP code on the affected WordPress site, which can lead to full compromise of the site environment.
What can be done if updating is not immediately possible?
Disable visitor attachments in AskAny to remove the exposed upload path until the plugin can be updated to version 2.2.0 or later.