CVE-2026-84171: WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. Exploitation requires the ability to submit a file upload request to the affected plugin.
Which installations should be treated as affected?
Installations using WP Images Upload on Piclect version 1.0 or earlier should be treated as affected. The issue is caused by missing validation of uploaded file names and types.
What is the likely impact if exploitation succeeds?
An attacker can upload arbitrary files into a publicly accessible directory. This can allow arbitrary code execution on the server.
How can defenders look for signs of exploitation?
Review the plugin's publicly accessible upload directory for unexpected files, especially non-image files or files with suspicious names and extensions. Investigate any files that were uploaded without an associated authenticated user action.