CVE-2026-12872: Webinfos WordPress Plugin RCE Vulnerability

CVE-2026-12872 Overview

CVE-2026-12872 is an unauthenticated arbitrary file upload vulnerability in the Webinfos WordPress plugin through version 1.2. The plugin fails to validate the type or name of uploaded files. It also lacks any authentication, capability, or nonce checks on the upload action. Unauthenticated attackers can upload arbitrary files, including PHP scripts, to a web-accessible directory. On servers that execute PHP from the uploads path, this results in remote code execution (RCE). The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated remote attackers can upload PHP files and achieve remote code execution on affected WordPress sites, leading to full server compromise.

Affected Products

Webinfos WordPress plugin versions up to and including 1.2
WordPress sites with the plugin installed and activated
Servers configured to execute PHP from the WordPress uploads directory

Discovery Timeline

2026-08-03 - CVE-2026-12872 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-12872

Vulnerability Analysis

The Webinfos plugin exposes a file upload handler that processes incoming files without validation. The handler does not verify the MIME type, file extension, or filename of the uploaded content. It also does not require authentication, capability checks, or WordPress nonce validation. Any remote actor can invoke the upload endpoint anonymously.

Because PHP files are accepted and written to a web-accessible directory, attackers can drop a webshell and access it directly via HTTP. Executing the uploaded script yields code execution under the web server user. From there, attackers can pivot to database credentials in wp-config.php, exfiltrate site data, deploy persistence, or move laterally within the hosting environment.

The vulnerability requires no privileges, no user interaction, and is exploitable over the network. Public exploitation typically requires only a single HTTP POST request to the vulnerable endpoint.

Root Cause

The root cause is the absence of three independent controls on the upload handler. First, there is no server-side validation of file type or extension, allowing executable content. Second, the endpoint has no current_user_can() capability check or authentication requirement. Third, no wp_verify_nonce() call protects the action against unauthenticated invocation. The combination allows arbitrary file placement in a directory served by the web server.

Attack Vector

An attacker sends a crafted multipart HTTP POST request to the plugin's upload endpoint, attaching a PHP file. The plugin writes the file to the uploads directory without inspection. The attacker then issues a GET request to the uploaded PHP file, triggering execution. Refer to the WPScan Vulnerability Details for the technical write-up.

Detection Methods for CVE-2026-12872

Indicators of Compromise

Unexpected .php, .phtml, or .phar files in wp-content/uploads/ or plugin-specific upload directories
HTTP POST requests to Webinfos plugin endpoints from unauthenticated sources
Outbound network connections initiated by the web server process to unfamiliar hosts
New administrator accounts or modified WordPress user roles following suspicious upload activity

Detection Strategies

Monitor web server access logs for POST requests to Webinfos plugin paths originating without an authenticated session cookie
Scan the WordPress uploads directory tree for files with executable PHP extensions or PHP shebangs inside image files
Alert on file integrity monitoring events for new files written to wp-content/uploads/ matching webshell signatures

Monitoring Recommendations

Enable WordPress activity logging to capture plugin file operations and administrative changes
Forward web server and PHP-FPM logs to a centralized SIEM for correlation with process execution telemetry
Track child processes spawned by the web server user, particularly shells, curl, wget, and python

How to Mitigate CVE-2026-12872

Immediate Actions Required

Deactivate and remove the Webinfos plugin from all WordPress installations until a patched version is released
Audit the wp-content/uploads/ directory for unauthorized PHP files and remove any identified webshells
Rotate WordPress administrator credentials, database passwords, and API keys stored in wp-config.php on any host that was exposed
Review web server logs for signs of prior exploitation dating back to plugin installation

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. All versions through 1.2 are affected. Consult the WPScan Vulnerability Details for updates on remediation status.

Workarounds

Block execution of PHP files within the WordPress uploads directory using web server configuration
Restrict access to the plugin's upload endpoint at the web application firewall (WAF) layer
Enforce authentication in front of the WordPress site while remediation is pending

bash

# Apache: prevent PHP execution in wp-content/uploads
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx: add to server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}