rootpwn

high · CVSS v3 8.8

CVE-2026-84738

The AF Companion WordPress plugin prior to version 2.2.0 lacks proper file type validation in an import feature. This oversight enables low-

Overview

The AF Companion WordPress plugin prior to version 2.2.0 lacks proper file type validation in an import feature. This oversight enables low-privileged store-management users to upload arbitrary files, potentially resulting in remote code execution on the underlying server.

Description

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.

Impact

The vulnerability primarily impacts the integrity and availability of the hosting server, along with the confidentiality of stored data. Successful exploitation allows authenticated users with store-management privileges to execute arbitrary code. This can lead to full system compromise from an authenticated perspective.

Remediation

Update the AF Companion WordPress plugin to version 2.2.0 or later where file type validation is properly enforced. Implement strict file upload restrictions and limit the assignment of store-management roles to trusted accounts only. Conduct regular security audits of user roles and installed plugins.

Risk context

Rated as a high severity issue with a CVSS v3 score of 8.8, posing a significant risk due to the potential for remote code execution. Defenders should prioritize immediate patching of the affected plugin to mitigate unauthorized access and system compromise.

Affected products

  • AF Companion WordPress plugin

Scores

Severity
high
CVSS v2
6.5
CVSS v3
8.8
CVSS v4
—
EPSS
—

wordpress plugin rce arbitrary-file-upload high-severity privilege-abuse

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-77169

A authorization bypass vulnerability exists in the team folders app when used alongside the workspace app. This flaw allows API-only delegated administrators to circumvent folder-level access restrictions. It matters because it undermines multi-tenant isolation and administrative privilege boundaries.

View analysis

high

CVE-2026-93313

An integer overflow vulnerability exists in Freedesktop Poppler version 26.07.0 within the JBIG2Stream::readCodeTableSeg function in poppler/JBIG2Stream.cc. This flaw can be triggered remotely via malicious PDF files containing crafted JBIG2 streams. It matters because successful exploitation could lead to application crashes or potentially arbitrary code execution in environments processing untrusted documents.

View analysis