[CVE-2026-81090] The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploa…

Descripción técnica

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

Puntuación CVSS

Score: 7.2/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Debilidades (CWE)

CWE-352, CWE-434

Fuente oficial

Publicado en NIST NVD.