CVE-2026-16985: Squeeze < 1.7.12 - Author+ Arbitrary File Upload
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/squeezeto a version that resolves this vulnerability.Fixed in 1.7.12 - Compensating control
Restrict the WordPress capability "upload_files" so only trusted roles/users have it (the issue is exploitable by users with upload_files capability, e.g., Author and above).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16985?
CVE-2026-16985 has a severity rating of 81, indicating a high risk of exploitation.
How do I fix CVE-2026-16985?
To fix CVE-2026-16985, update the Squeeze plugin to version 1.7.12 or later.
What type of vulnerability is CVE-2026-16985?
CVE-2026-16985 is classified as a Malicious File Upload vulnerability.
Who is affected by CVE-2026-16985?
Users with the upload_files capability, specifically Authors and above, are affected by CVE-2026-16985.
What can an attacker do with CVE-2026-16985?
An attacker exploiting CVE-2026-16985 can upload an executable PHP file to the uploads directory.