CVE-2026-81090: Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

Q: Who is exposed to exploitation?

Sites using Gpx2Graphics through version 0.3 are exposed if an attacker can induce a logged-in WordPress administrator to submit the upload request.

Q: What does an attacker need to exploit this issue?

The attacker needs to target a logged-in administrator with a CSRF attack. The vulnerable upload handler lacks CSRF protection and does not validate uploaded file types.

Q: What is the likely impact of successful exploitation?

An attacker may cause arbitrary files, including PHP files, to be uploaded. This can lead to remote code execution.

Published Sep 12, 2026

Updated

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

Affected Software

1 affected component

WordPress Gpx2Graphics<=0.3

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Sites using Gpx2Graphics through version 0.3 are exposed if an attacker can induce a logged-in WordPress administrator to submit the upload request.

What does an attacker need to exploit this issue?

The attacker needs to target a logged-in administrator with a CSRF attack. The vulnerable upload handler lacks CSRF protection and does not validate uploaded file types.

What is the likely impact of successful exploitation?

An attacker may cause arbitrary files, including PHP files, to be uploaded. This can lead to remote code execution.