WordPress Plugin Vulnerabilities

Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

Description

The plugin does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

Proof of Concept

Affects Plugins

Plugin icon
gpx2graphics
No known fix

References

CVE
CVE-2026-81090

Miscellaneous

Original Researcher
Huynh Kien Minh
Submitter
Huynh Kien Minh
Verified
Yes
WPVDB ID
92e50025-cfa4-4727-bd02-8f45196021ae

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2025-11-17
Title
Gravity Forms < 2.9.22 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
Published
2025-09-08
Title
Doccure < 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2023-11-20
Title
Theme Editor < 2.8 - Admin+ Arbitrary File Upload
Published
2025-04-16
Title
WP-Advanced-Search <= 3.3.9.3 - Authenticated (Admin+) Arbitrary File Upload
Published
2023-12-16
Title
EditorsKit < 1.40.4 - Authenticated (Administrator+) Arbitrary File Upload