WordPress Plugin Vulnerabilities

Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload

Description

The plugin does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

Proof of Concept

Affects Plugins

Plugin icon
ahime-image-printer
No known fix

References

CVE
CVE-2026-124833

Miscellaneous

Original Researcher
Khaled Alenazi (Nxploited)
Submitter
Khaled Alenazi (Nxploited)
Submitter website
https://github.com/Nxploited
Verified
Yes
WPVDB ID
3b24b6d4-061c-4229-9ced-c2306eee44ea

Timeline

Publicly Published
2026-11-11 (about 2 days ago)
Added
2026-11-11 (about 1 day ago)
Last Updated
2026-11-12 (about 7 hours ago)

Other

Published
Title
Published
2025-04-08
Title
WP Remote Thumbnail <= 1.3.2 - Contributor+ Arbitrary File Upload
Published
2025-04-17
Title
WPAMS <= 44.0 (17-08-2023) - Authenticated (Subscriber+) Arbitrary File Upload
Published
2026-10-17
Title
MapSVG – Vector maps, Image maps, Google Maps < 8.16.2 - Authenticated (Contributor+) Arbitrary File Upload
Published
2024-11-11
Title
Instant Image Generator < 1.5.3 - Unauthenticated Arbitrary File Upload
Published
2016-12-10
Title
Delete All Comments 2.0 - Unauthenticated Arbitrary File Upload