CVE-2026-2354

Name of the Vulnerable Software and Affected Versions Swiss Toolkit For WP versions prior to 1.4.7

Description An arbitrary file upload issue exists due to flawed file type validation in the upload extension files() function. The function uses strpos() to check if a filename contains a configured extension string instead of verifying the actual file extension. Authenticated attackers with Author-level access or higher can upload arbitrary files, such as PHP scripts, to the server, potentially leading to remote code execution. This is possible when the Enhanced Multi-Format Image Support feature is enabled with at least one allowed extension, such as avif.

Recommendations Update Swiss Toolkit For WP to version 1.4.7 or later. As a temporary mitigation, disable the Enhanced Multi-Format Image Support feature.