CVE-2026-4808

Name of the Vulnerable Software and Affected Versions Gerador de Certificados – DevApps plugin for WordPress versions up to and including 1.3.6

Description The Gerador de Certificados – DevApps plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the moveUploadedFile() function. This allows authenticated attackers with Administrator-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Update the Gerador de Certificados – DevApps plugin to a version later than 1.3.6.