File Upload Vulnerability in Advance Guest Post Plugin by WordPress
CVE-2026-118064
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 13 November 2026
Badges
What is CVE-2026-118064?
The Advance Guest Post plugin for WordPress fails to adequately restrict file uploads, making it possible for unauthenticated users to upload arbitrary PHP files. The plugin utilizes an insecure method that leverages a nonce visible to all front-end visitors, allowing an exploit through improper validation of uploaded files. The vulnerability is particularly critical for sites running PHP 7.x, as it enables remote code execution. However, on PHP 8.0 and later, an error occurs before file writing can take place, limiting the risk under those environments. Proper security measures are essential to protect against this threat.
Affected Version(s)
Advance Guest Post 0 <= 1.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.