WP images upload on piclect accepts unauthenticated executable uploads
WP images upload on piclect through 1.0 writes unauthenticated uploads to a publicly accessible directory without validating the file name or type. An attacker can upload a PHP file and request it over the web to execute arbitrary code. The authoritative export does not identify the upload handler, multipart field, or destination directory.
- Component
- WP images upload on piclect
- Plugin slug
wp-images-upload-on-piclect- Affected
- <= 1.0
- Safe version
- See mitigation notes
- Published
- Sep 12, 2026
This CVE was published Sep 12, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed release is confirmed in the authoritative export. Deactivate the plugin and remove untrusted files from its upload location. The application-level fix must authenticate and authorize uploads, generate server-side names, verify content and extension against a strict allowlist, and keep uploads non-executable.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H