CVE-2026-84171Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/e5b9fd87-92a7-4fc6-b8b2-896b87d97c40/

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

CyberSignal | Cybersecurity & AI News@XQOPTRX46d
Disclosure
🚨 NEW WORDPRESS RCE RISK: CVE-2026-84171 affects WP Images Upload on Piclect ≤1.0. The plugin fails to validate uploaded file names or types, allowing an unauthenticated attacker to upload arbitrary files to a public directory and potentially execute code on the server.
Post summary
A newly disclosed CVE-2026-84171 compromises the WP Images Upload plugin by enabling unauthenticated arbitrary file uploads, which can lead to remote code execution.
0101065
215 followersView on X

Explore more

Back to dashboard