File Upload Vulnerability in AskAny WordPress Plugin
CVE-2026-121497
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-121497?
The AskAny WordPress plugin prior to version 2.2.0 contains a significant flaw that allows unauthenticated users to upload arbitrary files. The plugin fails to properly validate both the extension and content of files attached to chat messages, relying instead on the file type reported by the browser. This vulnerability poses a serious risk, as it enables potential attackers to upload PHP files and execute malicious code when visitor attachments are enabled, compromising the security of affected WordPress installations.
Affected Version(s)
AskAny 0 < 2.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.