critical9.8
CVE-2026-84171
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible …
Impact
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
Affected products
| Product | Affected versions |
|---|---|
| WP Images Upload On Piclect WordPress Plugin | through 1.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.