CVE-2026-12872

Name of the Vulnerable Software and Affected Versions Webinfos WordPress plugin versions prior to 1.3

Description The plugin fails to validate the type or name of uploaded files and does not restrict the upload action with authentication, capability, or nonce checks. This allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, to a web-accessible directory. On servers that execute PHP from the uploads path, this can lead to remote code execution.

Recommendations Update the Webinfos WordPress plugin to a version newer than 1.2.