VULNERABILITY INTELLIGENCE
CVE-2026-15039
CVSS score9.8 CRITICAL
EPSS probability0.83%
CISA KEVNot currently listed
Published2026-08-12
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-434