WordPress Plugin Vulnerabilities
Askany < 2.2.0 - Unauthenticated Arbitrary File Upload
Description
The plugin does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.
Proof of Concept
Affects Plugins
Fixed in 2.2.0 References
CVE
Miscellaneous
Original Researcher
Ryan Fabella
Submitter
Ryan Fabella
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-10 (about 7 hours ago)
