{"affected":[{"defaultStatus":"unknown","product":"mView 豆瓣电影","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.3","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-115212","cwes":["CWE-434"],"description":"The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/c1fd09cb-0df7-4643-a888-1873c90e7b64/"}],"kev":null,"metrics":[],"modifiedAt":1794204025855,"publishedAt":1794204025855,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/c1fd09cb-0df7-4643-a888-1873c90e7b64/"}],"remediation":[],"revision":"c4ffec92e69b020fc2f2cbb3d60ab9a84dcdcf5a44d6f74b485d5dc55aca5b3f","sources":[{"modifiedAt":1794204025855,"name":"CNA: WPScan","retrievedAt":1794208105848,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115212"}],"ssvc":null,"status":"published","title":"mView <= 1.0.3 - Subscriber+ Arbitrary File Upload","updatedAt":1794208105848}