CVE-2026-13158: Everest Toolkit WordPress RCE Vulnerability

CVE-2026-13158 Overview

CVE-2026-13158 is an unrestricted file upload vulnerability [CWE-434] affecting the Everest Toolkit WordPress plugin through version 1.2.3. The plugin disables the WordPress file-type check during demo-content import. This allows authenticated users with high privileges to upload executable PHP files to the site's uploads directory. Administrators on standard installations, including non-super-admin site administrators on multisite deployments, can abuse this behavior to place arbitrary PHP code on the web server. Successful exploitation leads to remote code execution in the web server context.

Critical Impact
Authenticated administrators can upload arbitrary PHP files through the demo-content import feature, resulting in remote code execution on the underlying host.

Affected Products

Everest Toolkit WordPress plugin versions up to and including 1.2.3
WordPress single-site installations with an Administrator account
WordPress multisite deployments where non-super-admin site administrators can access the plugin

Discovery Timeline

2026-08-01 - CVE-2026-13158 published to the National Vulnerability Database
2026-08-05 - Last updated in the NVD database

Technical Details for CVE-2026-13158

Vulnerability Analysis

The Everest Toolkit plugin ships a demo-content importer intended to help site owners populate a new installation with sample posts, media, and configuration. During this import routine, the plugin explicitly disables the WordPress core file-type validation that normally rejects executable content in the uploads directory. Files provided to the importer are written to disk without MIME or extension enforcement.

Because the uploads directory is web-accessible under a default WordPress configuration, a PHP file placed there by the importer can be executed by requesting its URL. The attacker obtains arbitrary code execution as the web server user, with full read and write access to WordPress content and database credentials stored in wp-config.php.

Root Cause

The root cause is the plugin overriding or bypassing the wp_check_filetype_and_ext behavior during the import handler. WordPress provides this filter to allow developers to permit additional media formats, but disabling type validation entirely defeats the safeguard against script uploads. Combined with the absence of a secondary allow-list, any file extension, including .php, is accepted.

Attack Vector

Exploitation requires an authenticated session with Administrator privileges. On multisite, a site-level administrator without super-admin rights is sufficient, which broadens the trust boundary that must be considered. The attacker navigates to the Everest Toolkit demo-import interface and submits a crafted archive or file containing PHP source. After upload, the attacker requests the file directly from the uploads URL to trigger execution.

No verified public exploit code is available. Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-13158

Indicators of Compromise

New .php, .phtml, or .phar files present under wp-content/uploads/ that were not created by a known plugin or theme
Web server access logs showing direct GET or POST requests to PHP files inside wp-content/uploads/
Outbound network connections initiated by the PHP-FPM or Apache process to unfamiliar hosts following an administrator login

Detection Strategies

Monitor file-creation events in the WordPress uploads directory and alert on any executable script extension
Correlate administrator authentication events with subsequent file writes to detect abuse of the import feature
Inspect plugin audit logs for invocations of the Everest Toolkit demo-import endpoint followed by unusual file activity

Monitoring Recommendations

Enable file integrity monitoring across wp-content/uploads/ and treat any new PHP-executable file as high severity
Ingest WordPress and web server logs into a centralized SIEM and build detections for POST requests to Everest Toolkit import endpoints
Track privileged session activity on multisite installations, focusing on site administrators performing plugin imports

How to Mitigate CVE-2026-13158

Immediate Actions Required

Deactivate the Everest Toolkit plugin until a patched release addressing CVE-2026-13158 is installed
Audit the wp-content/uploads/ directory for unauthorized PHP files and remove any that are not part of a legitimate plugin or theme
Review Administrator and site-administrator accounts, rotate credentials, and enforce multi-factor authentication

Patch Information

At the time of publication, no fixed version is referenced in the advisory. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for a release beyond 1.2.3 that restores file-type validation in the demo-content importer.

Workarounds

Configure the web server to deny execution of PHP files inside wp-content/uploads/ using a directory-level rule
Restrict access to plugin administrative endpoints with IP allow-listing or a web application firewall rule targeting the Everest Toolkit import URL
On multisite, limit the plugin to super-admin control and remove site-administrator capability to run the demo-content importer

bash

# Apache: block PHP execution in the uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>

# Nginx: block PHP execution in the uploads directory
# Add to the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9]+)$ {
    deny all;
    return 403;
}