PT-2026-89773

CVE-2026-14560

Published

2026-09-11

Updated

2026-09-17

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions teddy-bear-customize-addon WordPress plugin versions prior to 1.0.6

Description The plugin fails to properly validate uploaded files by relying on a client-supplied content type and preserving the original filename. This allows unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

Recommendations Update the teddy-bear-customize-addon WordPress plugin to version 1.0.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

0Xbassia

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers