SVG File Upload Vulnerability in Blaze Demo Importer WordPress Plugin
CVE-2026-106933
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 October 2026
Badges
What is CVE-2026-106933?
The Blaze Demo Importer plugin for WordPress prior to version 1.0.17 contains a significant security flaw allowing authenticated users with the Author role or higher to upload malicious SVG files. This vulnerability arises due to the plugin's failure to sanitize uploaded SVG files properly. By exploiting this flaw, an attacker can upload a crafted SVG that runs arbitrary JavaScript in the browser of any user who opens the file, potentially compromising user sessions and exposing sensitive data. It is crucial for users of this plugin to upgrade to the latest version to mitigate these security risks.
Affected Version(s)
Blaze Demo Importer 0 < 1.0.17
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.