critical10.0
CVE-2026-14560
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preservi…
Impact
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
Affected products
| Product | Affected versions |
|---|---|
| Teddy-Bear-Customize-Addon WordPress Plugin | through 1.0.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.