File Upload Validation Vulnerability in Advance Guest Post Plugin for WordPress
CVE-2026-118063

Currently unrated

Key Information:

Vendor

WordPress
Status
Advance Guest Post
Vendor
CVE Published:
13 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118063?

The Advance Guest Post plugin for WordPress, in versions up to 1.9, exhibits a significant vulnerability due to improper validation of file uploads. This weakness stems from a case-sensitive and incomplete check of file extensions, which unauthenticated users can easily bypass. As a result, attackers can upload arbitrary files, including potentially dangerous executable PHP files, into web-accessible directories. The impact of this vulnerability could lead to remote code execution, contingent upon the specific server setup and configuration.

Affected Version(s)

Advance Guest Post 0 <= 1.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118063 - Proof of Concept

References

https://wpscan.com/vulnerability/45ea832a-9ed9-4f75-bc84-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

WPScan
.