PT-2026-90567 · Undefined · Undefined
CVE-2026-81402
·
Published
2026-09-12
·
Updated
2026-09-24
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DS Ad Rotator WordPress plugin versions prior to 0.9
Description
The image upload handler fails to perform capability checks, nonce verification, and file-type validation. This allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, to a web-accessible directory, potentially leading to remote code execution.
Recommendations
Update the DS Ad Rotator WordPress plugin to a version newer than 0.8.
Exploit
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Undefined