Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the 'kubio' attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress's normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
https://atomicedge.io/cve-proof/cve-2026-5427-kubio-version-2-7-2-medium-vulnerability-proof-of-concept CVE-2026-5427 #WordPress plugin #vulnerability kubio #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof of concept for CVE‑2026‑5427, affecting Kubio plugin version 2.7.2, is posted by Atom Ice Edge, underscoring a medium‑severity vulnerability.
CVE-2026-5427 The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_… https://www.cve.org/CVERecord?id=CVE-2026-5427
Post summary
The message announces CVE‑2026‑5427, stating that the Kubio plugin for WordPress allows arbitrary file upload due to missing capability checks, but provides no PoC, exploit, or mitigation.
CVE-2026-5427 Arbitrary File Upload in Kubio Plugin for WordPress Versions Up to 2.7.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5427
Post summary
The entry announces CVE-2026-5427, describing an arbitrary file upload flaw in Kubio Plugin for WordPress versions up to 2.7.2, without mentioning PoC, exploit, or patch information.