PT-2026-6057 · WordPress · Wp Foft Loader

Williwollo · Publicado 2026-02-04 · Atualizado 2026-02-09 · CVE-2026-1756

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP FOFT Loader plugin for WordPress versions through 2.1.39

Description The WP FOFT Loader plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation within the WP FOFT Loader Mimes::file and ext function. This allows authenticated attackers with Author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Update the WP FOFT Loader plugin to a version later than 2.1.39.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-1756

Produtos afetados

Wp Foft Loader

Referências · 7

• https://plugins.trac.wordpress.org/browser/wp-foft-loader/trunk/includes/class-wp-foft-loader-mimes.php?rev=3449144#L45 · Nota
• https://plugins.trac.wordpress.org/changeset/3453101/wp-foft-loader/trunk/includes/class-wp-foft-loader-mimes.php · Nota
• https://twitter.com/cracbot/status/2020814978983604710 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/cede8ff5-f739-4eb3-9672-5adb5d2ae0a9?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1756 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/wp-foft-loader/trunk/includes/class-wp-foft-loader-mimes.php?rev=3449144#L31 · Nota
• https://t.me/cveNotify/150820 · Publicação no Telegram