CVE-2026-84171 — WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowin…
Published: 2026-09-12 · CVSS: 9.8 · CVSS 3.1
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7