WordPress Plugin Vulnerabilities

WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

Description

The plugin does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.

Proof of Concept

Affects Plugins

Plugin icon
wp-images-upload-on-piclect
No known fix

References

CVE
CVE-2026-84171

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
e5b9fd87-92a7-4fc6-b8b2-896b87d97c40

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2025-05-08
Title
1 Click WordPress Migration Plugin – 100% FREE for a limited time < 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Published
2025-03-07
Title
SMTP by BestWebSoft < 1.2.0 - Authenticated (Administrator+) Arbitrary File Upload
Published
2022-04-11
Title
Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
Published
2024-04-22
Title
Newsletters < 4.9.6 - Authenticated (Admin+) Arbitrary File Upload
Published
2024-07-03
Title
IMGspider < 2.3.11 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'