WordPress security by component
gpx2graphics
gpx2graphics is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Sep 12, 2026; the highest published CVSS base score is 7.2.
Plugin slug:
gpx2graphicsLatest vulnerability
CVE-2026-81090: Gpx2Graphics upload CSRF can make an administrator install PHP
Gpx2Graphics through 0.3 neither verifies a CSRF token nor validates file type in its upload flow. An attacker can trick a logged-in administrator into submitting a forged upload that stores PHP and leads to remote code execution. The authoritative export does not identify the upload action, field, destination, or whether the file is directly web-accessible.
| Safe version |
|
||
|---|---|---|---|
| Sep 12, 2026 |
CVE-2026-81090
Gpx2Graphics upload CSRF can make an administrator install PHP
Gpx2Graphics through 0.3 neither verifies a CSRF token nor validates file type in its upload flow. An attacker can trick a logged-in administrator into submitting a forged upload that stores PHP and leads to remote code execution. The authoritative export does not identify the upload action, field, destination, or whether the file is directly web-accessible.
|
See mitigation notes |
CVE7.2
NVDPending
|