CVE-2026-104028 — Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content t…
Published: 2026-10-11 · CVSS: 9.8 · CVSS 3.1
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7