CRITICAL
CVE-2026-84171
CVSS
9.8
Description
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
Weakness (CWE)
CWE-434
Unrestricted File Upload
EPSS Score
0.37%
Probability of exploitation in next 30 days
31.2th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.