WordPress Plugin Vulnerabilities

Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

Description

The plugin does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
personal-qr-message
No known fix

References

CVE
CVE-2026-16250

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
05bd2683-ef3b-4816-a323-12d5e943612a

Timeline

Publicly Published
2026-07-24 (about 3 days ago)
Added
2026-07-24 (about 2 days ago)
Last Updated
2026-07-24 (about 2 days ago)

Other

Published
Title
Published
2014-08-01
Title
Reganto - Remote File Upload
Published
2022-01-12
Title
WP Ultimate CSV Importer < 6.4.1 - Subscriber+ Arbitrary File Upload
Published
2026-06-25
Title
Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
Published
2025-03-31
Title
Appointify <= 1.0.8 - Authenticated (Admin+) Arbitrary File Upload
Published
2024-05-13
Title
Kognetiks Chatbot for WordPress < 2.0.1 - Unauthenticated Arbitrary File Upload