CVE-2026-16985

Name of the Vulnerable Software and Affected Versions Squeeze WordPress plugin versions prior to 1.7.12

Description Insufficient validation of file types or extensions during attachment-update actions allows users with the upload files capability, such as those with Author privileges and above, to upload executable PHP files into the uploads directory. This flaw can lead to remote code execution, which is the ability of an attacker to execute arbitrary commands on the server.

Recommendations Update Squeeze WordPress plugin to version 1.7.12 or later.