{"affected":[{"defaultStatus":"unaffected","product":"AskAny","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.2.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121497","cwes":["CWE-434"],"description":"The AskAny  WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/e6aed436-10c6-403b-8d1a-0cf42f3e5aeb/"}],"kev":null,"metrics":[],"modifiedAt":1794376811121,"publishedAt":1794376811121,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e6aed436-10c6-403b-8d1a-0cf42f3e5aeb/"}],"remediation":[],"revision":"efc841af01b7574c5ec4982f43399c2262d188e241707b3ed81363333836ef73","sources":[{"modifiedAt":1794376811121,"name":"CNA: WPScan","retrievedAt":1794377395008,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121497"}],"ssvc":null,"status":"published","title":"Askany < 2.2.0 - Unauthenticated Arbitrary File Upload","updatedAt":1794377395008}