CVE-2026-14560: Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate to exploit the vulnerable upload handling. Any reachable site running the affected plugin through version 1.0.5 may be exposed.
What does an attacker need to upload a malicious file?
The upload validation relies on a client-supplied content type and keeps the supplied filename. An attacker can use this to upload a PHP file and execute code on the server.
How can I determine whether my site is affected?
Check whether the WordPress site has the teddy-bear-customize-addon plugin installed and whether its version is 1.0.5 or earlier. Review upload locations and server logs for unexpected PHP files or requests associated with the plugin's upload functionality.