CVE-2026-16250CWE-434unrestricted-file-upload

CVE-2026-16250

Critical · published August 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.1
In the wild
Unconfirmed
What it is

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00831 · 57.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-03T11:16Z
References (1)
https://wpscan.com/vulnerability/05bd2683-ef3b-4816-a323-12d5e943612a/ · [email protected]
EPSS history
Timeline
  • 03 AUG 06:00Z
    Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
    cvelistv5