Input Validation Flaw in All in One Files Upload Plugin by WordPress
CVE-2026-85573
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 September 2026
Badges
What is CVE-2026-85573?
The All in One Files Upload plugin for WordPress prior to version 2.0.17 introduces a significant security risk by permitting SVG files as allowable upload types. This vulnerability arises from the plugin's failure to properly sanitize these uploaded files or to verify the authenticity of public upload requests. Consequently, this enables unauthenticated users to potentially store malicious files on the site. When these compromised files are accessed by unsuspecting visitors, they can execute harmful active content within the site's environment, leading to severe security breaches.
Affected Version(s)
All in One Files Upload 2.0.3 < 2.0.17
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.