CVE-2026-16250: Personal QR Message WordPress RCE Flaw

CVE-2026-16250 Overview

CVE-2026-16250 is an unauthenticated arbitrary file upload vulnerability in the Personal QR Message WordPress plugin through version 1.0. The plugin exposes a file upload handler that does not validate or restrict file extensions or MIME types. Unauthenticated attackers can upload executable PHP files to a directly reachable location on the web server. Requesting the uploaded file triggers server-side execution, resulting in remote code execution (RCE) under the web server user context. The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated attackers can upload and execute arbitrary PHP code on any WordPress site running the affected plugin, leading to full site compromise.

Affected Products

Personal QR Message WordPress plugin — all versions through 1.0
WordPress installations with the plugin activated
Any hosting environment serving the plugin's upload directory as executable PHP

Discovery Timeline

2026-08-03 - CVE-2026-16250 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-16250

Vulnerability Analysis

The Personal QR Message plugin registers a file upload endpoint that is reachable without authentication. The handler accepts uploaded files without enforcing an allow-list of safe extensions or verifying MIME content. Uploaded files are written to a directory served directly by the web server. Because PHP handlers process any .php file in that path, an attacker can request the uploaded file to execute arbitrary server-side code.

Exploitation grants attacker-controlled code execution with the privileges of the PHP process. This typically enables database access, credential theft from wp-config.php, webshell persistence, lateral movement, and pivoting to other tenants on shared hosting.

Root Cause

The root cause is missing input validation on file uploads (CWE-434). The plugin fails to:

Enforce authentication and capability checks on the upload handler
Validate file extensions against an allow-list
Verify MIME type and file magic bytes
Rename uploaded files or store them outside the webroot
Restrict PHP execution in the upload directory

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to the plugin's upload endpoint containing a PHP payload with a .php extension. After the server writes the file to the plugin's upload directory, the attacker issues a GET request to the resulting URL to execute the payload. The full exploitation flow is documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16250

Indicators of Compromise

Unexpected .php, .phtml, or .phar files in the Personal QR Message plugin's upload directory under wp-content/
POST requests to the plugin's unauthenticated upload handler from unknown IP addresses
GET requests directly targeting .php files within wp-content/uploads/ or plugin-specific upload paths
Outbound network connections initiated by the www-data, apache, or nginx process to attacker infrastructure
New administrative WordPress users or modifications to wp-config.php shortly after upload activity

Detection Strategies

Inspect web server access logs for POST requests to plugin endpoints followed by GET requests to newly written .php files
Deploy file integrity monitoring on wp-content/uploads/ and plugin directories to alert on new executable files
Use YARA or signature scanning to identify common PHP webshell patterns such as eval($_POST, system($_GET, and base64_decode chains
Correlate upload events with subsequent process spawns from PHP-FPM or the web server process

Monitoring Recommendations

Enable verbose WordPress access logging and forward it to a centralized SIEM for correlation
Alert on child processes of the web server user executing shell utilities such as sh, bash, curl, or wget
Monitor for creation of files with double extensions such as image.jpg.php in web-accessible directories
Track HTTP 200 responses to previously nonexistent .php URLs under plugin paths

How to Mitigate CVE-2026-16250

Immediate Actions Required

Deactivate and remove the Personal QR Message plugin from all WordPress installations until a fixed version is released
Audit wp-content/uploads/ and plugin directories for unauthorized .php files and remove any webshells
Rotate WordPress administrative credentials, database credentials in wp-config.php, and API keys stored on the host
Review recently created WordPress users and scheduled tasks (wp_cron) for attacker persistence

Patch Information

No vendor patch is available at time of publication. The vulnerability affects the plugin through version 1.0 with no fixed release documented. Refer to the WPScan Vulnerability Report for updates on remediation status.

Workarounds

Remove the plugin entirely; deactivation alone may not prevent reachable endpoints
Deploy a web application firewall (WAF) rule to block requests to the plugin's upload handler
Disable PHP execution in wp-content/uploads/ using web server configuration
Restrict inbound access to /wp-admin/admin-ajax.php and plugin endpoints by IP where feasible

bash

# Apache: disable PHP execution in wp-content/uploads
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx: disable PHP execution in uploads directory
# Add to server block
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}