PT-2026-23403 · WordPress · Wp Chill Filr

Que Thanh Tuan · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-28133

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Chill Filr versions prior to 1.2.13

Description A flaw exists in WP Chill Filr filr-protection that permits the upload of a web shell to a web server. This is due to unrestricted file upload with a dangerous type. The issue allows for the potential compromise of the server through malicious file uploads.

Recommendations Update WP Chill Filr to version 1.2.13 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-28133

Affected Products

Wp Chill Filr

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-28133 · Security Note
• https://twitter.com/CVEnew/status/2029454829786153298 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/filr-protection/vulnerability/wordpress-filr-plugin-1-2-12-arbitrary-file-upload-vulnerability?_s_id=cve · Note