PT-2026-49223 · Undefined · Undefined

Published 2026-06-15 · Updated 2026-06-15 · CVE-2018-25436

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-25436

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25436 · Security Note
• https://wordpress.org/plugins/baggage-freight · Note
• https://kaimi.io · Note
• https://vulncheck.com/advisories/wordpress-plugin-baggage-freight-shipping-australia-arbitrary-file-upload · Note
• https://exploit-db.com/exploits/46061 · Note