critical9.0
CVE-2026-75799
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthe…
Impact
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
Affected products
| Product | Affected versions |
|---|---|
| YAHMAN Add-Ons WordPress Plugin | before 0.9.31 |
Versions were read from the advisory text. No structured product data has been published for this record yet.