File Upload Vulnerability in Giftware Plugin for WordPress
CVE-2026-15039
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15039?
The Giftware WordPress plugin prior to version 4.2.10 has a security flaw that fails to properly validate the type of uploaded files in certain upload paths. This oversight allows unauthenticated users to upload arbitrary files, including potentially malicious PHP scripts, which can be executed on the server. Such exploitation can lead to severe security breaches, including unauthorized access and control of the affected site.
Affected Version(s)
giftware 0 < 4.2.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.