WordPress Plugin Vulnerabilities

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

Description

The plugin does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

Proof of Concept

Affects Plugins

Plugin icon
teddy-bear-customize-addon
No known fix

References

CVE
CVE-2026-14560

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
10.0 (critical)

Miscellaneous

Original Researcher
0xBassia
Submitter
0xBassia
Submitter website
https://github.com/0xBassia
Submitter twitter
MohamedBassia
Verified
Yes
WPVDB ID
aba51906-91dc-4e75-ad44-373fe128deee

Timeline

Publicly Published
2026-09-09 (about 2 days ago)
Added
2026-09-09 (about 1 day ago)
Last Updated
2026-09-09 (about 1 day ago)

Other

Published
Title
Published
2026-08-19
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
Published
2026-02-10
Title
Lucky Wheel Giveaway < 1.0.23 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
Published
2026-05-01
Title
Widget Options < 4.2.3 - Contributor+ Remote Code Execution via Display Logic
Published
2025-01-07
Title
WordPress File Upload < 4.25.0 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
Published
2023-05-22
Title
Revolution Slider <= 6.6.12 - Author+ Remote Code Execution