CVE-2026-104028

Name of the Vulnerable Software and Affected Versions Anton Extensions versions prior to 1.2.3

Description An issue exists where the plugin fails to perform capability checks, nonce verification, and file-type validation before writing content to a chosen path. This allows unauthenticated attackers to upload arbitrary PHP files to attacker-controlled filesystem paths, which can lead to remote code execution. Nonce verification is a security measure used to protect against cross-site request forgery by ensuring that a request was intentionally sent by the user.

Recommendations Disable or remove the plugin installations. Restrict file-upload capabilities and prevent PHP execution in upload directories.