CVE-2026-81090CWE-352CWE-434unrestricted-file-uploadcsrf

CVE-2026-81090

High · published September 12, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00373 · 30.0th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-12T10:16Z
References (1)
https://wpscan.com/vulnerability/92e50025-cfa4-4727-bd02-8f45196021ae/ · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 12 SEP 06:00Z
    Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF
    cvelistv5