CVE-2026-124833: Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload
Published Nov 13, 2026
·Updated
The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.
Event History
Nov 13, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated attackers can exploit it; no WordPress account or prior authentication is required.
2
What can an attacker do after exploiting it?
An attacker can upload arbitrary files, including PHP files, and execute code on the server.
3
Which plugin versions are affected?
Ahime Image Printer versions through 1.0.0 are affected.