Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress's `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site's server which may make remote code execution possible, granted the "Enhanced Multi-Format Image Support" feature is enabled with at least one extension (e.g., avif) in the allowed formats.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-11 | 1 | Patch1 |
| 2026-07-12 | 2 | Disclosure2 |
CVE-2026-2354 The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` funct… https://www.cve.org/CVERecord?id=CVE-2026-2354
Post summary
The text announces that the Swiss Toolkit For WP WordPress plugin has an arbitrary file upload vulnerability caused by a flawed file type validation check.
🚨*CVE* CVE-2026-2354 The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` funct… https://www.cve.org/CVERecord?id=CVE-2026-2354 ----- Traducción: CVE-2026-2354 El … http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-2354, explaining it causes arbitrary file upload in the Swiss Toolkit For WP plugin due to a flaw, with no evidence of exploitation, patch, or PoC.
CVE-2026-2354 (CVSS 8.8): Swiss Toolkit For WP WordPress plugin vulnerable to arbitrary file upload. Update the plugin now if in use. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/u06rxYeF5S
Post summary
The tweet announces CVE‑2026‑2354 as a high‑severity arbitrary file upload flaw and urges users to update the faulty plugin.