CVE-2026-6101: AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwpsavelocalfont() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/amp-for-wpto a version that resolves this vulnerability.Fixed in 1.1.12 - Compensating control
Ensure the vulnerable plugin AMP for WP – Accelerated Mobile Pages is not available to non-admin roles: restrict Author-level (and above) access so authenticated users cannot abuse role-based access configuration to upload local fonts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6101?
The severity of CVE-2026-6101 is high, rated at 7.5.
How do I fix CVE-2026-6101?
To fix CVE-2026-6101, update the AMP for WP plugin to a version later than 1.1.12.
What is the impact of CVE-2026-6101?
CVE-2026-6101 allows authenticated users to perform arbitrary file write operations due to flawed role-based access configuration.
Which versions of AMP for WP are affected by CVE-2026-6101?
Versions of AMP for WP up to and including 1.1.12 are affected by CVE-2026-6101.
How can CVE-2026-6101 be exploited?
CVE-2026-6101 can be exploited through unsafe ZIP file extraction in the ampforwp_save_local_font() function, allowing for unauthorized file uploads.