Improper File Type Validation in Application Allows Code Execution

CVE-2026-14946

What is CVE-2026-14946?

A remote attacker with high privileges can exploit a vulnerability in a WordPress plugin due to inadequate validation of uploaded file types. This flaw allows an attacker to upload a .php file and subsequently invoke it through the uploads directory, leading to arbitrary code execution. Such exploitation may result in unauthorized access and complete system control, highlighting critical concerns for site integrity and data protection.

References