Blog A WordPress core RCE hiding inside a PNG upload
A WordPress core RCE hiding inside a PNG upload
WordPress 7.0.4 patches an author-level Imagick RCE that smuggles its payload inside a PNG, and five plugin criticals land on NVD — most of them pre-auth.
Some vulnerabilities read like party tricks. An author-level account on any WordPress site whose media pipeline ends in ImageMagick could upload a file the parser accepted as a PNG and Imagick treated as something else entirely — enough to hand the attacker code execution on the host. It needs a logged-in author account, so it isn’t a drive-by, but on a multi-author site an author account is not exactly a fortress. Patched in 7.0.4.
The plugin side of the week was worse in aggregate. product-input-fields-for-woocommerce ships an accepted-file-types setting whose documentation cheerfully claims that leaving it blank means “all files”. The implementation matched the documentation: no validation at all, and an unauthenticated upload endpoint that will happily accept a PHP file and drop it under wp-content/uploads/. That is remote code execution on any server that still runs uploaded files. Patched in 2.0.2. CVE-2026-19089.
infinitewp-client has a Multisite bug that is worse than it sounds. On network installs, the plugin fails to verify both the site-connection state and the authenticity of incoming requests to its remote-management endpoint, which lets an unauthenticated attacker bind their own management key, hijack an administrator session, and take over the whole network. Fixed in 1.13.6. CVE-2026-15038.
Two smaller plugins land the same pattern from different angles. foodboxbooker (CVE-2026-16298, fixed in 1.0.7) and single-sign-on-for-tng (CVE-2026-16299, fixed in 2.2.0) both skipped validation on the password-reset flow, so an unauthenticated request can reset an arbitrary user’s password — administrators included. The install bases are tiny, but the bug class is a reminder that password-reset endpoints are the softest place to look for admin takeover, and they keep being written the same wrong way.
formidable-digital-signatures rounds it out with an arbitrary-file-deletion bug in delete_file: an unauthenticated caller who can guess a file path can drop it via item_meta[field_id][content]. Deleting wp-config.php is the usual trick — WordPress then walks the next visitor through the installer, which is often enough to seize the database. Patched in 3.0.7. CVE-2026-16230.
The through-line here is that most of these are code-execution or full-takeover primitives that land before the attacker has touched a login form. A scanner that only looks for known-bad file hashes will miss them; one that watches uploads, checks integrity against the wordpress.org versions of the plugins it knows, and flags password-reset flows that skip capability checks will catch them earlier. That is the shape Segurium is built around.
For sites that want a WordPress malware scanner and cleanup tool aimed at exactly this kind of plugin-borne compromise, Segurium is available on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #cve