WordPress Plugin Vulnerabilities

WpStream < 4.11.2 - Subscriber+ File Upload

Description

The plugin is vulnerable to file uploads due to missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload allowed files (such as images etc, handled by wp_handle_upload() ) on the affected site's server

Affects Plugins

Plugin icon
wpstream
Fixed in 4.11.2

References

CVE
CVE-2026-39527
URL
https://vdp.patchstack.com/database/wordpress/plugin/wpstream/vulnerability/wordpress-wpstream-plugin-4-11-2-arbitrary-file-upload-vulnerability

Miscellaneous

Original Researcher
Muhammad Sharief (Md Sharief)
Verified
No
WPVDB ID
78c4197e-7094-44f6-a94b-791d3839ba30

Timeline

Publicly Published
2026-04-17 (about 6 months ago)
Added
2026-04-21 (about 5 months ago)
Last Updated
2026-04-22 (about 5 months ago)

Other

Published
Title
Published
2014-08-01
Title
Xerte Online <= 0.35 - File Upload
Published
2015-02-22
Title
Holding Pattern Theme <= 0.6 - Arbitrary File Upload
Published
2023-12-27
Title
WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload
Published
2026-10-07
Title
Bricksforge < 3.1.8.10 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
Published
2026-03-05
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.6 - Unauthenticated Arbitrary File Upload