CVE-2026-1756: WP FOFT Loader Plugin RCE Vulnerability

CVE-2026-1756 Overview

CVE-2026-1756 is an arbitrary file upload vulnerability affecting the WP FOFT Loader plugin for WordPress. The vulnerability exists due to incorrect file type validation in the WP_FOFT_Loader_Mimes::file_and_ext function in all versions up to and including 2.1.39. This security flaw enables authenticated attackers with Author-level access and above to upload arbitrary files on affected WordPress sites, potentially leading to remote code execution.

Critical Impact

Authenticated attackers can bypass file type validation to upload malicious files, including PHP web shells, potentially achieving full remote code execution on affected WordPress servers.

Affected Products

• WP FOFT Loader plugin for WordPress versions up to and including 2.1.39
• WordPress installations using vulnerable versions of the WP FOFT Loader plugin
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2026-02-04 - CVE-2026-1756 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-1756

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw resides in the file type validation mechanism within the WP_FOFT_Loader_Mimes::file_and_ext function. The plugin fails to properly validate uploaded file types, allowing authenticated users with Author privileges or higher to bypass security controls and upload files with arbitrary extensions.

The vulnerability requires network access and low-privilege authentication (Author-level account), but once these conditions are met, exploitation requires no user interaction. A successful attack can result in complete compromise of confidentiality, integrity, and availability of the affected WordPress installation.

Root Cause

The root cause of this vulnerability is improper file type validation in the plugin's MIME type handling class. The WP_FOFT_Loader_Mimes::file_and_ext function, located in class-wp-foft-loader-mimes.php, does not adequately verify that uploaded files match their claimed MIME types. This allows attackers to upload files with dangerous extensions (such as .php) by manipulating file headers or exploiting weaknesses in the validation logic.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with at least Author-level privileges on the target WordPress installation. The attacker can exploit the vulnerability by:

1. Authenticating to the WordPress site with an Author or higher-level account
2. Accessing the WP FOFT Loader plugin's file upload functionality
3. Crafting a malicious file (such as a PHP web shell) that bypasses the flawed validation
4. Uploading the malicious file to the server
5. Accessing the uploaded file directly to execute arbitrary code

The vulnerability mechanism involves bypassing the file type validation in the file_and_ext function. Detailed technical analysis is available in the WordPress Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1756

Indicators of Compromise

• Unexpected PHP files or other executable scripts appearing in WordPress upload directories
• Web server logs showing requests to unusual file paths within the wp-content/uploads directory
• Author-level user accounts making repeated file upload requests to the WP FOFT Loader plugin
• Presence of web shells or backdoor files in directories accessible by the plugin

Detection Strategies

• Monitor WordPress file upload directories for newly created files with executable extensions (.php, .phtml, .php5, etc.)
• Implement file integrity monitoring on WordPress installations to detect unauthorized file changes
• Review web server access logs for suspicious POST requests targeting WP FOFT Loader endpoints
• Deploy Web Application Firewall (WAF) rules to detect and block file upload exploitation attempts

Monitoring Recommendations

• Enable detailed logging for WordPress plugin activities and file upload operations
• Configure alerts for any executable files created in the wp-content directory structure
• Monitor for anomalous behavior from Author-level user accounts, including unusual upload patterns
• Implement regular malware scanning on WordPress installations using the WP FOFT Loader plugin

How to Mitigate CVE-2026-1756

Immediate Actions Required

• Update the WP FOFT Loader plugin to version 2.1.40 or later immediately
• Audit WordPress installations for any unauthorized files that may have been uploaded
• Review user accounts with Author-level access or higher for signs of compromise
• Temporarily disable the WP FOFT Loader plugin if an immediate update is not possible

Patch Information

A security patch has been released by the plugin maintainers to address this vulnerability. The fix is documented in the WordPress Changeset Update. Users should update to the latest version of the WP FOFT Loader plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

Workarounds

• Restrict Author-level access to only trusted users until the plugin can be updated
• Implement server-side controls to prevent PHP execution in WordPress upload directories
• Use security plugins with file upload monitoring capabilities to detect exploitation attempts
• Consider temporarily deactivating the WP FOFT Loader plugin until a patched version can be installed

# Disable PHP execution in uploads directory (Apache .htaccess)
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.php$">
    Order Deny,Allow
    Deny from all
</FilesMatch>