VulnSocial

CVE-2026-87935General

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-17); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-17: 1Mentions · 2026-09-18: 1Patch / Workaround · 2026-09-18: 1Technical Details · 2026-09-18: 109-1709-18
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-171
General1
2026-09-181
Patch1
Full discourse2 posts
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-87935 (CVSS 8.1): Paid Downloads WordPress plugin vulnerable to arbitrary file upload in versions <=3.15. Check and update if in use. https://nvd.nist.gov/vuln/detail/CVE-2026-87935 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/HRJ2oZKb6k

    Post summary

    The tweet discloses CVE-2026-87935, an arbitrary file upload vulnerability in the Paid Downloads WordPress plugin (versions <=3.15, CVSS 8.1), and explicitly advises users to update the plugin as remediation.

    0001049
    97 followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidad en Complemento de WordPress ❗ CVE-2026-87935 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-complemento-de-wordpress-14/ https://t.co/KHa6KMB84T

    Post summary

    The tweet announces CVE-2026-87935 in a WordPress plugin and shares links, but provides no PoC, exploit, active exploitation claim, patch, or technical details.

    00000255
    6.7K followersView on X

Explore more

Back to dashboard