{"affected":[{"defaultStatus":"unknown","product":"Advance Guest Post","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118063","cwes":["CWE-434"],"description":"The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/45ea832a-9ed9-4f75-bc84-1b09794d362a/"}],"kev":null,"metrics":[],"modifiedAt":1794549606947,"publishedAt":1794549606947,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/45ea832a-9ed9-4f75-bc84-1b09794d362a/"}],"remediation":[],"revision":"3ba7e8e4ff21af5740e9a47bcfa766b743dd81b9aa5930e058b337ee8297ba43","sources":[{"modifiedAt":1794549606947,"name":"CNA: WPScan","retrievedAt":1794550126397,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118063"}],"ssvc":null,"status":"published","title":"Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_action","updatedAt":1794550126397}