CVE-2026-81402: DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit the vulnerable image upload handler. No WordPress account, capability, or valid nonce is required.
What must be true for exploitation to lead to remote code execution?
The attacker must be able to submit a file to the plugin's upload handler. Because the handler accepts arbitrary files, including PHP, and stores them in a web-accessible directory, an uploaded PHP file can potentially be executed remotely.
Are default upload restrictions sufficient to prevent exploitation?
No. The affected handler does not perform file-type validation, so it does not enforce restrictions that would prevent PHP or other arbitrary file uploads.