CRITICAL
CVE-2026-81402
CVSS
9.8
Description
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
Weakness (CWE)
CWE-434
Unrestricted File Upload
EPSS Score
0.45%
Probability of exploitation in next 30 days
38.4th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.