CVE-2026-75799: YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YAHMAN Add-ons WordPress pluginto a version that resolves this vulnerability.Fixed in 0.9.31
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Sites using YAHMAN Add-ons versions earlier than 0.9.31 are exposed when the relevant blog card cache feature is enabled. No attacker authentication is required.
What does an attacker need to achieve remote code execution?
An attacker needs the vulnerable feature to be enabled and must be able to cause a remote file to be cached. The plugin does not validate the type of remote files written to the publicly accessible cache directory, allowing PHP files to be written and executed.
Does the issue affect the plugin's default configuration?
The available information only states that exploitation requires the relevant feature to be enabled. It does not specify whether that feature is enabled by default.